Web › Module 6 › Lesson 4
Lab — Design Review Note
One review note: assets, logic invariants, race controls — app YOU own only.
Visual · design_review_lab
Clipboard with three sections: threat model, business rules, concurrency. — router login STOP — then SAFE No stranger prod.
Opening
The lab is a design review you could hand a teammate — not a hunt on the internet.
OWASP Top 10:2025 A06 Insecure Design is proven here by writing one locked design-review note for a feature on an app YOU own, a loopback toy, or a clearly labeled hypothetical you invent. You pull Lessons 1–3 together: assets and abuse cases, business invariants, and race/limit controls. Practical commands start with identify on http://192.168.0.1/ — if that IP is a home router login, STOP and Attack literacy stays; foreign targets stay out. Pedagogy: own-lab proof → fix/report. The “fix” is the control list and any gap you found on your stack. Next is the module quiz. Today: one artifact under $HOME/cyberlium-lab, chmod 600.
1. Scope: DEMO you own, 127.0.0.1:8773, or invented feature — never café prod
Allowed targets: http://192.168.0.1/ only if it is YOUR lab app (not router admin), a service you run on 127.0.0.1:8773, a personal project repo, or a paper design for a feature you invent labeled HYPOTHETICAL-OWNED. Forbidden: school SSO, café POS, neighbor shops, LAN nmap, hydra, random bug-bounty without program rules you already have. If you have no code, invent a coupon+cart feature and review it honestly — empty “I scanned the mall Wi-Fi” fails.
Teaching processes bind HOST="127.0.0.1" only. Do not accept a URL argument. Reports use http://192.168.0.1/ as the demo asset even when curls ran on SAFE.
2. Section A — threat model lite carry-forward
Copy forward (or rewrite): assets, actors, three abuse cases, trust boundaries. Mark which abuse cases are still open. If all are “mitigated,” say which control closed each. Vague “secured” without a control name fails the lab.
Command guide
A06 Design — Section A - threat model lite carry-forward
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8773"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 10
3. Section B — business logic invariants
List invariants: money, quantity, uniqueness, workflow edges. Name client fields that must be recomputed server-side. Attach coupon toy curl evidence if you ran Lesson 2. If you found a gap on YOUR app, write expected vs actual and the fix. No payment PoCs against strangers.
4. Section C — race and limit design
For every limit (once, max N, budget), state whether check-then-act is possible and what atomic control you require. Attach results from your local HTTP counter on 8773. Bank-steal writeups are failing content even as “references.”
5. Wrong vs right: stranger hunt vs locked review on your stack
Same word “lab,” opposite ethics.
Wrong
Probe café/school checkouts. Hydra the router. nmap the LAN. Include card data. Ship race PoCs against live brands. chmod 777 public gist of secrets.
Right
Identify DEMO; router → SAFE. Complete design-review-lab.txt on owned/loopback/hypothetical-owned; sections A–C filled; chmod 600. Next: Quiz — Insecure Design.
6. Hands-on: identify + design-review-lab.txt
Run identify curls, optionally re-start the 8773 toy, scaffold the note, then fill every blank. Empty ethics lines fail. Router-admin URLs in the report fail ethics.
Mission: design-review-lab.txt complete (mode 600)
1) 0.0.1:8773.2) Choose owned, loopback, or hypothetical-owned scope. Fill sections A–C with named controls. 3) chmod 600 $HOME/cyberlium-lab/design-review-lab.txt. No foreign hosts. No bank PoCs. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If you have no app, ask for a hint to invent a coupon+cart hypothetical — not a target list. Try: "Hint only: how to fill A/B/C for an invented checkout I own on paper; why 192.168.0.1 router login is OUT OF SCOPE; what empty lines fail?" You still write the locked note.
You now hold one A06 design review artifact: threat, logic, concurrency — on systems you own, with DEMO identify curls and SAFE 8773. Original Cyberlium — not official OWASP certification. Next — Quiz — Insecure Design — ten APPLY items.
Knowledge Check
APPLY: You have no deployed app. What is the ethical lab completion?
Multiple choice
Knowledge Check
APPLY: True or False: Changing HOST from 127.0.0.1 to a café IP makes the design review more realistic and still allowed.
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows Huawei “Router Admin.” Report that URL as the A06 asset?
Multiple choice