The part of security work above the tools is permission. This set covers what written authorisation contains, why a spoken yes is not enough, the four kinds of system you might face, and why testing anything you do not own is an offence in most countries.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Write rules of engagement for your own lab
Before you test anything, write down the scope, the window, the limits and the contact. This writes a short rules of engagement document for your own phone and reads it back. Every line is a decision about what you are allowed to touch.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
mkdir -p ~/lab; printf "scope: my own phone and its Termux install\nwindow: 2026-10-25, 09:00 to 17:00\nout of bounds: shared storage and every other device\ncontact: me, on this device\n" > ~/lab/roe.txt; cat ~/lab/roe.txt; echo "---"; wc -l < ~/lab/roe.txt
Four lines: scope, window, what is out of bounds, and the contact.
the document states what is in scope
it states what is out of bounds
it names who to call if something breaks
the commands actually ran
What a good answer looks like
Four lines naming the scope, the time window, what is out of bounds, and the contact, then a divider and a line count. On your own lab the contact is you, but the shape is the one you would use for a system that was not yours. Notice that the out-of-bounds line rules out shared storage, the one place on a phone where other apps could be affected.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.