A flight simulator for security
Pilots learn on a simulator, not on a real plane with passengers.
Security people learn the same way. The labs in this lesson are websites that are broken on purpose. Each one is your own private copy.
Here you see how the attacks from earlier lessons really work, so you can learn to stop them.
The one rule
data-callouts.warning.label
Attack only your own lab copy, and nothing else. It has no way out to the internet, so nobody else is affected. Trying these things on a system that is not yours is a crime in the UK under the Computer Misuse Act 1990. It does not matter if you were curious or meant no harm.
Key words
| Word | What it means | Example |
|---|---|---|
| Lab | A private practice system that is yours alone. | a practice shop that is broken on purpose |
| Vulnerable on purpose | Built with weak points so students can learn from them. | a shop with a weak search box |
| Permission | The owner says you may test. Your own lab copy always gives it. | a letter from the owner |
| Evidence | Proof of what you did and what you saw. | a screenshot |
| Report | A short write-up of what you found and how to fix it. | a lab report |
| SQL injection | Typed text that changes the question a program asks its stored data. | a search box that shows secrets |
| Cross-site scripting | An attacker makes a page run their code in other people's browsers. | a harmful comment |
| Brute force | Trying many passwords, one after another, until one works. | trying 1000 passwords |
| Authentication | Proving that you are who you say you are. | a password |
| MFA | Multi-factor authentication: a second proof you are you, as well as a password. | a code sent to your phone |
| Access control | Rules that say who may see or change what. | only staff open the admin page |
| Defence | A way to stop or reduce an attack. | checking input |
| CIA triad | Three things security protects: confidentiality (kept secret), integrity (not changed) and availability (there when needed). | a leak breaks confidentiality |
The cells students fill in are left blank in this preview.
Quick check: the rule
Have a go
Quick check: the rule
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Which lab shows which threat?
| Lab | What it is | Threats and weak points you meet |
|---|---|---|
| Juice Shop | An online shop with many weak points | SQL injection, cross-site scripting, weak passwords |
| DVWA | A web app with levels from easy to hard | SQL injection, cross-site scripting, brute force |
| WebGoat | A course of guided security lessons | Injection, access control, old parts with known weak points |
| Mutillidae | A web app with hints and levels | Injection, cross-site scripting, weak input checks |
| WrongSecrets | Secrets kept in the wrong places | Passwords and keys left in code or settings |
| Linux privilege escalation | A machine with three ordinary mistakes | A user given too much power, weak settings |
The cells students fill in are left blank in this preview.
How to work in a lab
Three steps in every lab.
1. Read. Read what the lab says it is for.
2. Try. Press Start. Do what the lab asks. Keep notes of what you see.
3. Defend. Ask: how would a company stop this? Write it down. This is the part that matters most.