◇ OpenCyber Academy
Bachelor's · Chapter 25 · English

Chapter 25 — Laboratory I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 25 — Laboratory I

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 Notebook"]
  N2["25.2 Peer check"]
  N3["25.3 Planted fault"]
  N4["25.4 Time box"]
  N5["25.5 No production"]
  N6["25.6 Sign-off"]
  N7["25.7 The missing SWIFT exclusion"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 Notebook"]
  N2["25.2 Peer check"]
  N3["25.3 Planted fault"]
  N4["25.4 Time box"]
  N5["25.5 No production"]
  N6["25.6 Sign-off"]
  N7["25.7 The missing SWIFT exclusion"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 Notebook]
    |
    v
[25.2 Peer check]
    |
    v
[25.3 Planted fault]
    |
    v
[25.4 Time box]
    |
    v
[25.5 No production]
    |
    v
[25.6 Sign-off]
    |
    v
[25.7 The missing SWIFT exclusion]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) run scope, Wilson and flow labs under supervision; (2) peer-check; (3) refuse bad evidence.

25.1 Notebook

Outputs of lab_scope, lab_wilson, lab_flows with initials.

The laboratory notebook is the evidence that the learner ran the tools, not that they read about them. Each required output is pasted or attached with the learner's initials and the time. Initials matter because shared screenshots circulate. A notebook without outputs fails regardless of how polished the prose is. Supervisors check that the pasted numbers match what the pinned script versions produce, which is why script hashes appear later in the chapter.

25.2 Peer check

Compare scope classifications.

After running lab_scope, learners swap notebooks and re-classify the same target list without looking at each other's answers. Disagreements are discussed against the written scope file, not against memory. The peer check catches systematic misreadings, such as treating the SWIFT exclusion as optional, and it trains the habit of having a second person confirm scope decisions before a real window. A clean peer check is part of the lab's pass criteria. When peers still disagree after reading the file, the supervisor rules and the ambiguous line is sent to the scope author as a drafting fix.

25.3 Planted fault

Refuse mismatched hash evidence.

One evidence file in the lab pack has a hash that does not match the accompanying note. Learners who file it anyway fail that station. The point is emotional as well as technical. Refusing evidence feels like slowing down, and in a timed lab that pressure is deliberate. The correct action is to stop, record the mismatch and request a fresh capture. Transferring that refusal into real engagements is the habit the station exists to build.

25.4 Time box

Two hours hard stop.

Real windows end. The lab ends too, even if a station is unfinished. Learners practise writing what they completed, what they did not and what they would do next, which is the same discipline Sam uses when a testing night runs out of time. Extending the lab for struggling learners would teach the wrong lesson. Time boxes also keep peer checks fair: everyone has the same clock. Supervisors grade the hand-off note as seriously as the completed stations, because an honest list of unfinished work is what lets a colleague resume safely the next night.

25.5 No production

Live TRB scanning fails the lab.

The lab environment uses documentation-range addresses and synthetic data. Any attempt to point tools at live TRB systems, even out of enthusiasm, is an automatic fail and a conversation with the supervisor. The rule protects the bank and the learner. Authorization for the lab is authorization for the lab. Curiosity about production belongs in a planned engagement with a signed scope, not in a classroom exercise. The lab network has no route to TRB ranges, so the rule is also enforced technically, and any blocked attempt appears in the lab firewall log the supervisor reviews.

25.6 Sign-off

Supervisor signs on discipline, not novelty.

A passing lab shows careful scope checks, honest hashing, completed notebooks and respect for stops. Fancy extra techniques that were not asked for do not raise the grade, and they can lower it if they violate a rule. Supervisors sign a short rubric: scope correct, hash refusal demonstrated, outputs present, no production contact. Novelty is welcome in later research chapters. Laboratory I rewards discipline. A learner who finished every station but filed the mismatched evidence does not pass, while one who refused it and ran out of time on a later station usually does.

25.7 The missing SWIFT exclusion

Lab I planted faults include a scope file with SWIFT removed from exclusions. Learners who do not notice fail. Sam failed that variant once as a student and now writes exclusions first every time.

The variant works because learners often check that in-scope ranges look right and forget to check that exclusions are still present. Sam's lasting habit from failing it is to read the exclusion list before the inclusion list. The lab keeps the variant because the failure is cheap in a classroom and expensive in a real window.

25.8 Pinning lab script versions

Lab notebooks include hashes of the lab scripts used. Version skew is a common excuse Sam removes by pinning hashes.

Without hashes, a learner whose numbers differ from the key can claim they ran a different script version, and the supervisor cannot easily check. With hashes, the notebook shows exactly which bytes ran. Pinning also protects learners. If the lab maintainers change a script mid-term, the hash mismatch explains a surprise result instead of looking like learner error. The hash list sits at the top of the notebook, and the supervisor's first check is to recompute one hash before reading any results.

25.9 Rotating planted variants

The planted scope variant is rotated so word cannot spread between sittings. Sam keeps three variants.

If every sitting saw the same missing SWIFT line, the afternoon cohort would hear about it at lunch. Three variants keep the peer check honest: missing exclusion, renamed exclusion and exclusion only in an appendix. Learners are told that variants exist, so memorising one answer is obviously useless. Facilitators draw the variant from a sealed envelope at the start of each sitting. Variants differ only in where the exclusion problem hides, so every learner faces the same skill under a different disguise and grades stay comparable.

25.10 Exclusions by asset id

Lab I variant B hides an exclusion by renaming SWIFT to "pay-gw-01". Learners who only string-search "SWIFT" fail. Sam teaches exclusion by asset id, not by marketing name.

Real inventories rename things. A gateway that staff call SWIFT may appear in the asset register under a hostname. Checking exclusions by the names people use in conversation misses those rows. The lab's renamed variant makes that failure mode personal. Learners who pass it leave with a habit of matching asset identifiers, not slogans.

25.11 Exclusions hiding in appendices

Variant C uses an exclusion listed only in an appendix table. Learners who skip appendices fail. Sam loves appendix discipline.

Scope documents bury important rows in appendices more often than anyone admits. Variant C is slightly cruel and very realistic. The fix is a reading order: cover page, exclusion appendix, then inclusion ranges. Learners who adopt that order stop failing C and stop missing exclusions in real rules of engagement. The appendix variant also teaches that a scope document's structure is part of its meaning; a table at the back can carry as much authority as the cover page.

25.12 Laminated asset-id reminders

Asset-id exclusions are printed on the lab desk laminated card.

The card lists the three identifiers that must appear in every scope check for the lab's fictional bank. It is a scaffold for the habit, not a substitute for reading the scope file. Learners may use it during Laboratory I and are expected to work without it in later labs. Lamination survives spilled coffee, which is a more common lab hazard than instructors admit. Learners record in the notebook whether they used the card, which lets supervisors see who is ready to drop the scaffold.

25.13 Voiding old laminated cards

Laminated cards are versioned; old cards are hole-punched as void.

An outdated card is worse than no card, because learners trust it. When asset identifiers change, new cards are issued and old ones are hole-punched so they cannot be reused at a glance. The version number on the card matches the lab pack version. Facilitators check the match before each sitting as part of opening the room. The void cards go into a box on the facilitator's desk, which doubles as a quick history of how often the lab's identifiers changed.

25.14 Showing a real failed notebook

Laboratory I briefings show a failed notebook from a prior year (with permission) where hashing was skipped. Seeing a real fail is more persuasive than a rubric bullet. Sam thanks the alumnus who allowed the anonymised share.

Permission and anonymisation are mandatory; the point is the missing hash, not the person. Learners who see the fail ask better questions about their own notebooks. Rubric bullets describe the standard. A real miss makes the standard felt. Each new cohort sees a different anonymised failure where possible, so the example does not become a familiar story everyone tunes out.

Worked example (synthetic TRB)

Sam refuses planted bad evidence and catches a peer marking SWIFT in scope.

Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.

Errors and limits

This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.

Exercises

Synthesis

Lab I grades authorization discipline and evidence integrity.

Continue studying — chapter 25 of 40

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →