Lion Cipher Lab
Wrap a plaintext TCP service in TLS with stunnel
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A huge amount of software still speaks plaintext over the network. Old internal tools, databases left on their default settings, homegrown line-based daemons, industrial and appliance protocols — they send usernames, session tokens, query results and secrets as readable text across the wire. Anyone who can watch that wire (a compromised switch, a rogue device on the LAN, a curious admin, an attacker who already has a foothold) can read all of it, and often change it, without breaking anything or leaving an obvious trace. The clean fix is TLS — the same encryption that protects HTTPS — but you…
What you'll learn
- explaining, from zero, what 'plaintext over TCP' means and why a secret sent to a cleartext service is readable by anyone who can watch the wire
- reading a packet capture: running tcpdump on the loopback interface and spotting an ASCII secret sitting in the raw bytes of a TCP payload
- generating a self-signed X.509 certificate and private key with a single openssl command, and understanding what the cert and key are for
- writing an stunnel config: what the accept and connect directives mean, the difference between a server section and a client section (client = yes), and running both ends on one box
- putting stunnel in FRONT of an unmodified service so its traffic is encrypted in transit without changing a single line of the service's code
- proving the fix by re-capturing the SAME secret on the stunnel hop and seeing only TLS ciphertext — while the service still returns the correct value end to end
- judgment: when to reach for stunnel (a legacy app you can't change) versus when NOT to (the app can do native TLS — do that instead of adding a hop that can fail)
- the honest limits: stunnel encrypts only the hop between its two endpoints, and a self-signed cert gives encryption but NOT authentication unless the client sets verifyChain and CAfile
Steps in this lab
- The problem: plaintext over TCP, in one breath
- When stunnel is the right tool — and when it is NOT
- Stand up the plaintext service (a Redis in Docker)
- BEFORE: capture the secret travelling in the clear
- Make a certificate: one openssl command
- Write the stunnel config: accept, connect, and two ends
- AFTER: capture the same secret — now it's ciphertext
- The honest limits: encryption is not authentication, and only the hop is covered
- What you did — and why it sticks