Unit 10: Capstone: review the shop · Lesson 1 of 4 · 16 min
Scope and plan
A review starts with what you are allowed to touch and a checklist of what to cover.
mission
- You are
- The analyst leading the shop's web security review.
- Situation
- You have one day on the lab shop, authorised in writing, no access to real customer data. The template is in
review/report-template.md. - Goal
- Set the scope and build a checklist from the units you have done.
- Hand in
- A filled scope section and a checklist.
A review as an inspection round
Read the template
sed -n '1,12p' report-template.md
# Web security review: Example Shop
Reviewer:
Date:
Scope: http://127.0.0.1:8000 and https://shop.internal:8443
## Summary
## Findings
| ID | Finding | Where | Severity | Fix |
| --- | --- | --- | --- | --- |
you should see Sections for scope, findings, what is already good and retest notes.
Confirm what is in scope
curl -s -o /dev/null -w 'http %{http_code}\n' http://127.0.0.1:8000/ http 200 curl -s -o /dev/null -w 'https %{http_code}\n' --cacert certs/shop-ca.crt https://shop.internal:8443/ https 200
you should see Both the HTTP and HTTPS sites answer. Those two origins are your scope, nothing else.
defender tip Scope is a safety boundary, not a formality. Testing anything outside the written scope, including other hosts the app links to, is off limits.
Gather the case evidence
The case files from earlier units left evidence in your home folder. List it so nothing is forgotten in the report.
ls cases
cloud
gateway
inventory
logins
monitoring
rotation
support
transfer
you should see One folder per case file. Each is a finding or a control to check in the final review.
The checklist
| Command | What it does |
|---|---|
Transport | TLS version, certificate, HSTS |
Headers | The security header baseline on every route |
Auth | Password storage, rate limit, session lifecycle, MFA |
Access control | Who can read what, CORS, framing |
API | Tokens, field exposure, limits |
AI features | Where data goes, prompt and tool safety |
What a defender takes away
- 1Written scope and authorisation come before any request.
- 2A checklist keeps a review repeatable and complete.
- 3Record the exact targets so a retest hits the same ground.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.