Home labs & practical projects

Trace an input-handling flaw through source code

A project to do with your own tools, with guidance on what to create and capture.

Authorised security lab Suggested time: 3–4 hoursYour own authorised environment

What you could create

A deliberately vulnerable training application passes user input through several functions. You need to explain the trust-boundary failure and propose a regression test.

Example evidence format

Project evidence map (example)

Annotated source reviewScope and inputs

Remediation patch proposal and test casesDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Annotated source review	Show the inputs, scope and decisions behind this record. The analysis cites the relevant functions and data transformations.
Remediation patch proposal and test cases	Include the evidence supporting your conclusion. The proposed fix preserves intended behaviour and has a regression test.

What you'll need

Authorised security lab

Use source code from an authorised educational application in an isolated environment. Choose one guided vulnerability with clear training documentation.

Project record

Keep the working files for annotated source review and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

Use a deliberately vulnerable local image or a licensed training range. Check the provider’s access terms and current price.

Only test systems you own or are explicitly authorised to assess. Keep targets isolated and use synthetic accounts and data.

Suggested milestones

1
Plan and investigate
Trace input from entry point to the sensitive operation.
2
Develop your approach
Explain why the existing validation is insufficient in that code path.
3
Verify and explain
Propose a code-level fix and tests for both legitimate input and the unsafe case.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Annotated source review
Show the inputs, scope and decisions behind this record. The analysis cites the relevant functions and data transformations.
2
Remediation patch proposal and test cases
Include the evidence supporting your conclusion. The proposed fix preserves intended behaviour and has a regression test.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your annotated source review needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Use source code from an authorised educational application in an isolated environment. Choose one guided vulnerability with clear training documentation.

What a good result looks like

The analysis cites the relevant functions and data transformations.
The proposed fix preserves intended behaviour and has a regression test.

Finish the project

Revert target snapshots, remove test accounts and artefacts, and store a sanitised report. Do not publish credentials or working attack material.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.