Computer Security — Labs¶
Hands-on labs for the EPITA Computer Security course. Work in your pair, on your own laptop, inside your NotesApp clone from Class 2.
Class 5 — HTTPS & password storage (2 h)¶
Two defenses, two different problems:
- HTTPS protects data on the wire — between your browser and the server.
- Password hashing protects data at rest — inside the database.
Missing either one, and the other does not save you. Today you build both.
| Lab | What you do | Time |
|---|---|---|
| Lab 0 — Set up before class | Install Docker + Wireshark, clone NotesApp | ~15 min, at home |
| Lab 1 — Traffic-in-transit audit | Prove a login leaks over HTTP, turn on HTTPS, prove it stops, judge the cert | ~45 min |
| Lab 2 — Password storage audit | Crack weak hashes, fix with Argon2, measure how much the fix buys | ~35–40 min |
Project 2 launches today
Your group project — a command-line password manager — starts at the end of this class. Groups of 2–3, due 12 Nov, 25% of your grade. Read the brief tonight.
Ethics — only your own targets
Every attack in these labs runs only on data you generated yourself, from the course's own seed data, or on your own NotesApp clone. The techniques are identical to what you would run against a real leaked database — that is exactly why they only ever touch targets you are allowed to touch. This is your ethics charter, in practice.
Before you start¶
You need:
- Docker with the Compose plugin (
docker compose versionshould work). - Wireshark — free, from wireshark.org/download.
-
Your NotesApp clone. If you lost it:
Work as a pair
One person drives the keyboard, the other reads steps out loud and checks the checkpoints — then swap. Stuck for more than two minutes? Don't debug in silence — scroll to the Troubleshooting box at the bottom of the page. Every common blocker is listed there with a fix.
Do Lab 0 — Setup before class
Installing Docker and Wireshark (especially on Windows) can need a reboot. Get the three setup checkmarks green at home so you don't lose lab time to installs.