This is the capstone exercise for the curriculum. The earlier lessons taught individual vulnerability classes in isolation. The capstone joins three of them - reconnaissance, broken access control, and SQL-injection-based credential extraction - into a single end-to-end chain that ends with full administrative control of the embedded Nebula application.
In this lab you will:
- Reconnoitre the application surface and identify the administrator's account.
- Confirm a broken access control signal by reaching the administration page as a non-administrative user.
- Compose a UNION-based SQL injection payload that extracts the user table, including the administrator's password hash.
- Authenticate as the administrator with the recovered credentials.
- Write a short remediation report that names, for each phase of the chain, the control which would have broken the chain at that phase.
Estimated time: thirty to forty-five minutes of active exercise time, assuming the Nebula application is already running and you have a browser with developer tools open. If you still need to start the application, add the setup time described in the nebula-setup guide before beginning.
Prerequisites: the following lessons are required before starting this lab — do not skip them. Without these you will not have the skills to complete the SQL injection phase independently.
broken-access-control— the access-control bypass in phase two depends on the concepts from that lesson.sql-injection-data-extraction— phase three asks you to compose a UNION-based payload targeting a specific table; the SQL injection lesson is where that technique is taught.authentication-login— phase four requires you to authenticate with a recovered password hash; the authentication lesson explains the login flow you will use.
You should also be comfortable with the developer tools network panel and with reading JSON responses before starting.
Authorization note: the techniques rehearsed in this lab are used in authorized penetration testing engagements, in capture-the-flag competitions, and in personal lab environments such as the embedded Nebula application. Performing them against an application or system you do not own and are not authorized to test is a criminal offense in most jurisdictions. Nebula is the safe environment in which to practice. Treat it as such.
When you are ready to begin reconnaissance, acknowledge to continue.