Lion Cipher Lab
Virtual-patch a SQL injection tonight, or wait for the code fix?
- AppSec / DevSecOps
- Intermediate
- ~70 min
- Free · no account required
Why it matters
It is 9pm, an endpoint on your product is taking a SQL injection, and the clean fix needs a release cycle you do not have tonight. A virtual patch, a filter rule dropped in front of the app, can cut the exposure in minutes without shipping code. The trap is treating that rule as the fix. In this lab you build the rule, then measure it: it stops 85% of a labelled attack set and wrongly blocks 19% of real customer searches, while the one-line parameterized query stops 100% with zero false positives. The skill a security engineer is paid for here is not writing the regex; it is knowing what it…
What you'll learn
- standing up a tiny vulnerable Python web app (stdlib http.server + sqlite3) on your own machine, safely and offline
- seeing a SQL injection leak an unlisted record live, with curl, and reading the HTTP status that proves it
- writing a virtual patch as a negative-model regex filter that sits in front of the bug, with no code release
- measuring a defence honestly: block rate over labelled attack variants and false-positive rate over labelled real traffic
- finding what a regex WAF rule misses (a UNION ALL evasion) and why it false-positives on names like D'Or and search terms with -- or ;
- proving that the parameterized-query fix blocks 100% with 0 false positives, and deploys as fast as the rule when the fix is one line
- choosing between virtual patch now, feature-flag the endpoint off, and an emergency hotfix across KEV, internet-facing, compliance-window and risky-fix scenarios, and defending the call
- writing the exception with an expiry date so the stopgap cannot quietly become permanent
Steps in this lab
- The decision you are actually making, and the words you need
- Set up: a folder and a working Python (no installs)
- Save the vulnerable app and the filter it will call
- See the leak live, before you defend anything
- Build the measurement sets: labelled attacks and labelled real traffic
- Measure both defences against both sets
- Watch the virtual patch work, and watch it fail, live
- Now the code fix, and why it wins on the numbers
- The third number: time-to-protect, the only axis the virtual patch wins
- The judgment: four scenarios, pick a path and defend it
- Honest negatives: what the rule misses, why WAF rules rot, and the expiry date
- What you built, and the reflex to keep