Lab · Cyber Security: from zero to SOC analyst
Lab: is this file the real one?
The brief
An accounts office in Surat downloads its billing software and keeps important files on a shared PC. You use SHA-256 hashes in Python to verify a download and to spot which files have been changed, then hash a real file on your own computer.
Why it matters
Hashes are how you know a download was not tampered with, how antivirus tools recognise known malware, and how file integrity monitoring (part of PCI DSS and many audits) spots changes to important files. Analysts compare hashes every day.
Skills you practise
- SHA-256 with hashlib
- comparing hashes safely
- file integrity monitoring
- certutil and sha256sum
You need
- Your own Windows, Linux or macOS computer, and any installer or file you downloaded from an official site that publishes its SHA-256 hash
What you will have at the end
integrity.py, a tested hash checker and change detector, and a real download verified on your own computer.
How it is marked (rubric, 100 points)
| Correct functionsAll three functions pass, including the published SHA-256 test value and new or missing files. | 50 |
|---|---|
| Real verificationA real file was hashed with SHA-256 and compared with the official published hash. | 25 |
| UnderstandingYou can explain why hashes detect changes and why MD5 and SHA-1 are no longer trusted for security. | 15 |
| Readable codeShort functions with clear names. | 10 |
0/4 steps done
Step 1 of 4
Hash some text
sha256_text(text) returns the SHA-256 hash of the text as 64 lower-case hex characters.
A hash function turns any data into a fixed-size fingerprint. Change one letter and the fingerprint changes completely. hashlib works on bytes, so turn the text into bytes with .encode("utf-8") first, then call .hexdigest() for the readable hex form.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.