Web › Module 7 › Lesson 4
Lab — Auth Hardening on Loopback
Loopback checklist: MFA/secrets, cookies, JWT verify — HOST=127.0.0.1 only.
Visual · auth_hardening_lab
Clipboard: login, session, JWT. — router STOP — SAFE Accounts YOU own. No sprays, no steal kits.
Opening
The lab hardens proofs you control — it does not hunt other people’s logins.
OWASP Top 10:2025 A07 Authentication Failures is practiced here as an auth-hardening checklist against a loopback app YOU run, or account hygiene on services YOU own, recorded in auth-hardening-lab.txt. Pull Lessons 1–3: weak auth patterns, session flags/lifecycle, JWT verify rules. Identify Fix/report = ticks with evidence lines (header names, config keys) — not stolen sessions. Next: module quiz.
1. Scope lock: DEMO you own, HOST="127.0.0.1:8774", accounts you own
Teaching processes bind HOST="127.0.0.1" only. Do not accept CLI URLs. If 192.168.0.1 shows router admin, that host is OUT OF SCOPE — no hydra. If you have no local app, complete the account-hygiene section (MFA, unique passwords, recovery review) for accounts YOU control — still no secrets in the file. Campus SSO sprays fail the lab.
2. Section A — authentication patterns
Tick: unique passwords/manager, MFA where available, generic login errors or conscious tradeoff, rate limit/lockout plan, reset token properties. Write config locations on YOUR app if applicable.
Command guide
A07 Authn — Section A - authentication patterns
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8774"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 12
3. Section B — session and cookies
Tick: Secure/HttpOnly/SameSite, rotate on login, server revoke on logout, timeouts. curl -sS -D - only to DEMO if it is YOUR app, else SAFE 8774. No cookie-steal tooling.
Command guide
A07 Authn — Section B - session and cookies
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8774"
Command — copy this
curl -sS -m 3 -D - "$SAFE/" | grep -i set-cookie
4. Section C — JWT (if used) or N/A
Tick: alg allowlist, verify not decode-only, exp/iss/aud, secrets in env. If your app has no JWT, write N/A and why. Do not forge against foreign IdPs or live APIs.
5. Wrong vs right: foreign spray vs locked loopback checklist
Same word “lab,” opposite ethics.
Wrong
Hydra campus SSO or 192.168.0.1 router. BeEF. Paste live JWT secrets. nmap the LAN. Bind 0.0.0.0. Forge against cloud metadata.
Right
Identify DEMO; router → SAFE. Complete auth-hardening-lab.txt on owned/loopback scope; chmod 600. Next: Quiz — Authentication Failures.
6. Hands-on: identify + auth-hardening-lab.txt
Run identify curls. Optionally start a07_cookie_toy.py on 8774 from Lesson 2. Fill every section. Empty ethics fail.
Command guide
auth_hardening_lab.sh — DEMO identify + A07 loopback checklist
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install python3
macOS:
Command — copy this
brew install nmap brew install python3
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cd "$HOME/cyberlium-lab"
Command — copy this
cat > a07_lab_practical_commands.sh << 'SH' SH
Command — copy this
{Mission: auth-hardening-lab.txt (mode 600)
1) 0.0.1:8774.2) Choose loopback app and/or accounts you own. Fill sections A–C with evidence lines (no live secrets). 3) chmod 600 $HOME/cyberlium-lab/auth-hardening-lab.txt. No hydra. No nmap. No steal kits.
Stuck? Ask Cyberlium AI Mentor
If you lack a local app, ask how to finish via account hygiene — not for a target URL. Try: "Hint only: how to complete A/B/C with accounts I own and N/A for JWT; why 192.168.0.1 router login is OUT OF SCOPE; where the locked note lives?"
A07 hardening is evidence on systems you own — DEMO identify plus SAFE 8774. Original Cyberlium — not official OWASP certification. Next — Quiz — Authentication Failures.
Knowledge Check
APPLY: No local app. Ethical completion?
Multiple choice
Knowledge Check
APPLY: True or False: Pasting a production JWT HMAC secret into the lab file is fine for “evidence.”
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ is router admin. Lab HOST becomes the router?
Multiple choice