A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Input validation works best when it is semantic. A file path is not validated the same way as an IP address, and a TCP port is not validated the same way as a username. Start from the smallest set of values the script truly accepts, then reject everything outside that contract before any security-sensitive command runs.
| Question to ask | Why it matters |
|---|---|
| Validate paths, hosts, ports, and modes according to their data type | Keeps the lesson tied to an observable security outcome. |
| Failure signal | Use exit status and raw evidence to separate “no finding” from “check failed”. |
For a controlled lab target, a CIDR or host list can be checked for syntax and then intersected with the declared scope. For file paths, decide whether relative paths are allowed, whether symlinks are acceptable, and which directory roots are valid. Validation is about policy, not merely pattern matching.
Checks that a candidate port contains only decimal digits before numeric validation. The useful habit here is to treat the command output as evidence about one system fact, not as a magical diagnosis.
Bash arithmetic has its own hazards with leading signs and empty strings. When accepting a port number, make the conversion explicit and enforce the numeric range. Never let malformed input fall through to a command simply because a regex matched part of it.
A simple lab-scope pattern gate for the declared training subnet; real CIDR containment needs more exact logic. Read the result in context: the same command can be correct yet insufficient if a permission boundary, alternate configuration, or different backend changes what it reports.
Confirms a path currently names a regular file without executing or opening it. In a production workflow, save the raw result when the observation contributes to a finding. That keeps later analysis honest and makes troubleshooting reproducible.
A practitioner’s checkpoint: compare the observed behavior with the assumption your script is about to make. If the assumption is broader than the evidence, narrow the rule. If the evidence is incomplete, report the uncertainty instead of converting it into a confident finding.
Lab discipline: stay inside the declared course environment, prefer read-only checks for learning exercises, and preserve the original output of security tools before transforming it.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.