🔐 Security Lab
6 exercise sets. Master the English vocabulary used across cybersecurity disciplines — from vulnerability disclosure and threat modeling to penetration testing, incident response, and secure code review.
OWASP Top 10 Vocabulary
Injection, broken auth, IDOR, security misconfiguration — communicating OWASP Top 10 vulnerabilities in English.
CVE & Vulnerability Language
CVE IDs, CVSS scores, severity classification, disclosure vocabulary, and reading security advisories.
Threat Modeling Vocabulary
STRIDE, attack surface, trust boundary, threat actor, mitigation — vocabulary for structured threat modeling.
Penetration Testing Language
White-box/black-box, scope of engagement, reconnaissance, pivoting, reporting vocabulary for security assessments.
Security Incident Communication
Communicating security incidents: indicators of compromise, containment, remediation, mandatory breach reporting.
AppSec & Secure Code Review Language
Secure code review vocabulary: input validation, sanitization, SAST/DAST, security review findings.
Frequently Asked Questions
What is a 'buffer overflow' and how does it relate to the lab exercises?
A buffer overflow occurs when you write data beyond the allocated memory space of a buffer, often leading to crashes or allowing attackers to overwrite adjacent memory. The lab exercises frequently utilize vulnerable programs where user input isn't properly validated, creating opportunities for exploiting this weakness by sending oversized data.
I'm seeing 'Segmentation Fault' errors – what does that mean in the context of these labs?
'Segmentation Fault' typically indicates a memory access violation, often due to accessing memory outside the bounds of an allocated block. In the lab exercises, this usually happens when you attempt to read or write data beyond the intended boundaries of an array or other data structure, triggering a protection mechanism.
What's 'SQL injection'? Can I use SQL commands in the CoderLingo labs?
'SQL Injection' happens when user input is directly incorporated into SQL queries without proper sanitization, allowing attackers to manipulate database operations. While some lab exercises might involve interacting with databases, they are carefully designed to prevent direct SQL command injection through parameterized queries or escaping techniques.
The labs use 'shellcode' – what exactly is that and why is it there?
Shellcode is small, self-contained machine code designed to execute commands on a target system. The lab exercises utilize shellcode as a payload to demonstrate how vulnerabilities can be exploited to gain control of the system, often by executing malicious programs or commands.
What's 'XSS'? Does CoderLingo offer labs with Cross-Site Scripting challenges?
'Cross-Site Scripting (XSS)' allows attackers to inject malicious scripts into websites viewed by other users. The lab exercises may include scenarios where you need to identify and mitigate XSS vulnerabilities, typically through proper input validation or output encoding when displaying user-provided data.
I'm getting errors about 'stack overflow'. How does this relate to the labs?
A stack overflow happens when a function calls itself recursively too many times, exceeding the available space on the call stack. The lab exercises might involve recursive algorithms or functions where improper handling of the return address can lead to this type of error and potentially allow for control flow manipulation.
What is 'least privilege' and why should I consider it when running the lab exercises?
'Least privilege' dictates that a user or process should only have access to the resources necessary to perform its intended task. Applying this principle during lab exercises helps prevent accidental damage or unauthorized actions by limiting the potential impact of vulnerabilities being exploited.
What is 'fuzzing' and how can I use it in these labs?
'Fuzzing' involves providing a program with invalid, unexpected, or random input to trigger errors and identify vulnerabilities. The lab exercises might include scenarios where you're tasked with using fuzzing tools to discover weaknesses in the software by generating diverse test inputs.
What is 'rootkit' and how does it relate to the security labs?
'Rootkits' are a collection of tools used by attackers to hide their presence on a system, allowing them to maintain persistent access. The lab exercises may present scenarios where you need to detect or remove a rootkit from a compromised system, demonstrating stealthy attack techniques.
Can I use debuggers like GDB in the CoderLingo labs?
Yes, the lab environment is designed to allow you to utilize debuggers such as GDB (or similar) to step through code execution, inspect memory contents, and identify the root cause of vulnerabilities. This is a crucial tool for understanding how attacks occur and developing effective defenses.