Customizing Security Labs lessons

You can create your own labs using Security Labs as a sandbox, customize the lab assignments and deadlines you give to individual users, and customize the concluding text of labs.

You must contact your Veracode Security Labs team to enable creating your own labs.

Create lessons

You can create lessons using Security Labs as a sandbox. If you need help, Veracode can provide you with a template, or you can create a lesson from scratch.

Before you begin:

Veracode must enable this feature, and you must be the Security Labs standalone administrator to customize labs.

To complete this task:

1. In the Veracode Security labs, go to the Update page. A list of your modules opens.
2. To create a module that holds one or more lessons, select Add new module. Or, scroll down to an existing module into which you want to add lessons and select Edit module lessons.
3. From the top left select Add new lesson. The new lesson window opens.
4. Add the title of your new lesson.
5. Add the slug of your lesson. The slug is the last subdirectory of the URL for your lesson. For example, if you add node-sqli, the URL of your lesson is http://securitylabs.veracode.com/lesson/node-sqli.
6. To specify the language of your lesson, select a stack.
7. Select a display type.
8. Optionally, to determine the order in which your users see your module relative to other modules, enter an integer for Order.
9. Optionally, to categorize your lesson, select a focus from Focus.
10. Select Save new lesson. The edit page of the lesson opens.

Edit lessons

You can edit the lessons in your modules.

Before you begin:

Veracode must enable this feature, and you must be the Security Labs standalone administrator to customize labs.

To complete this task:

1. Go to the Update page. A list of your modules opens.
2. Select the module with the lab you want to edit. The edit screen of the module opens.
3. From the top left, select Edit module lessons. The Lessons screen opens with a list of the lessons on the left.
4. Select the edit icon next to the lab you want to edit. The edit page of the lesson opens.

Create modules

Modules are topic holders for one or more labs.

Before you begin:

Veracode must enable this feature, and you must be the Security Labs standalone administrator to customize labs.

To complete this task:

1. Go to the Update page. A list of your modules opens.
2. Select Add new module. The new module title window opens.
3. Add the title of the new module.
4. Select Save new module. Your new module appears below.
5. Add a description.
6. For Category, select a category for your audience. If you don't know the category, select owasp.
7. Optionally, to determine the order in which your users see your module relative to other modules, enter an integer for Order.
8. Select Update module.
9. From the top left of your module, select Edit module lessons. The Lessons page opens.
10. Select Add new lesson.
11. Add your lessons.
12. Save your lessons.
13. From the top left, select BACK TO MODULES. The Modules window opens.
14. To publish your module, scroll down to your module and clear Unpublished.
15. Select Update Module.

Edit modules

You can edit the title, description, permissions, categories, and labs of your modules.

Before you begin:

Veracode must enable this feature, and you must be the Security Labs standalone administrator to customize labs.

To complete this task:

1. Go to the Update page. A list of your modules opens.
2. Select the module to edit. The edit window opens.
3. Edit the title, description, permissions, categories, and order of your module.
4. Select Update module.

Security Labs - edit lesson page

Overview

Feature	Description
Stack	The language of your lesson.
Slug	The last subdirectory of the URL for your lesson. For example, if you add node-sqli, the URL of your lesson is http://securitylabs.veracode.com/lesson/node-sqli.
Display type	More information.
Allow others to view this lesson?	Publish or unpublish a lesson. Any team members can still access an unpublished lesson if they have a direct link to the lab URL, but you cannot assign the lesson to users until you publish.
Prevent future edits?	To prevent changes to the lesson, select Locked.
Topic	Enter a value to appear in place of the words this topic for the modal shown at the beginning and end of the lesson. This modal displays the message Rate your familiarity with this topic.
Points	Optionally, assign points for the difficulty of the lab. 10 points is most common for lessons with average difficulty. For more difficult lessons, increase the points a user can earn to 20 or 30.

Setup

Feature	Description
Is this a lesson or a challenge?	Select Challenge or Lesson. Challenge labs are typically more difficult and do not provide step-by-step guidance to users. They list as {Title} Challenge and provide a warning to your users that they should be familiar with the topic.
Servers	A Docker image based on the applications identified by a language and a security topic.
Additional server setup commands	Optionally, include additional setup code. This code runs in Bash shell as the root user after a user selects the lab.
Expand paths	Automatically expand any folders in the GUI editor.
Editor hints	Place a red dot next to the name of any file or folder specified in the GUI editor.

Content

You can write all content in Markdown.

To display the current lab URL of the user, use the escape sequence {$VIRTUAL_HOST} in any lesson text. For example, {$VIRTUAL_HOST}/api displays as https://xxxxxx.vsl.dev/api.

Feature	Description
Conclusion	Shows as a final step of instruction text in place of the phrase "You have completed this lab!".
Steps	Select to add steps.
Summary	Summarize the steps the user needs to take.
Hint	Displays if the user has been on a step for a long time, or tries to select Next before completing a step.
Solution	Provide a solution for the step that is visible only to administrators.
Checks	To determine if the user can progress to the next step, select to run checks every few seconds on a step. The check is Bash code that runs as the root user on the container, and the result is the exact terminal output expected from running the check.

Display types in lessons

Display type determines how the lab interface displays to a user in a lesson. The following tables describes the display types and how they change lab interfaces:

Display type	Lab interface change
site	Shows the terminal, GUI editor, the web application of the lab in an iframe, and automatically boots the web application.
site (no iframe)	Automatically boots the application of the lab, but does not show an iframe. To open the application in a new tab, your users must select the URL.
terminal	Shows only the terminal interface and the GUI file editor. You might want to use this feature for topics that are not specific to application security, such as a forensics lab.
terminal (no editor)	Shows only the terminal, but not the file editor. You might want to use this feature for topics that are not specific to application security and do not require users to modify files.
external	This is CTF-style (Capture the flag). It shows no terminal or application interface, and only shows an input box. You might want to use this feature for open-research-type labs or quizzes.

Customize concluding content

You can customize the concluding text of labs. For example, to make labs more personal to your learners, add your own policy documents or code examples.

Before you begin:

You must be the Security Labs standalone administrator.

To complete this task:

1. Go to the Campaigns page.
2. Select Customize content. The Customize lab conclusions page opens.
3. Under the lab you want to customize, select Customize or Modify custom text. A text box opens.
4. Write or edit your concluding text. To add hyperlinks, use Markdown.
5. Select Update conclusion.