Platform Engineer

One free single-file download (Terraform). No account, no cloud provider, no credit card, and nothing here can cost you money — you will be creating files on your own disk, not servers. Delete the binary afterwards if you like.

1. 1

   Get the tool

   Download Terraform from terraform.io — it is a single executable. Put it somewhere on your PATH, or just work in the folder you downloaded it to. Check it runs.

   Any

   terraform -version

2. 2

   Describe something that does not exist yet

   Make a new empty folder and create a file called main.tf. You are not writing instructions here — you are describing a desired end state, and that distinction is the whole idea.

   Any

   terraform {
     required_providers {
       local = { source = "hashicorp/local" }
     }
   }
   
   resource "local_file" "hello" {
     filename = "${path.module}/out/hello.txt"
     content  = "built by terraform\n"
   }

3. 3

   Ask what it WOULD do

   Initialise, then run a plan. Read the output properly. It tells you exactly what will be created, changed or destroyed, and nothing has happened yet. This preview-before-acting habit is most of what separates infrastructure people who are safe from ones who are not.

   Any

   terraform init
   terraform plan

4. 4

   Make it real

   Apply it. Look in the out/ folder — the file exists. Now run plan again: it reports no changes, because reality already matches your description.

   Any

   terraform apply
   terraform plan

5. 5

   Break reality and watch it notice

   Delete the file it made, by hand. Run plan again. It has detected drift — reality no longer matches the description — and it tells you precisely how to get back. Apply again and it repairs itself. This is the moment the idea usually lands.

   Any

   terraform plan
   terraform apply

6. 6

   Add three more, then destroy everything

   Change the resource to create three files instead of one using count = 3. Plan, apply. Then run destroy: everything it made is gone, and only your description remains. You can rebuild it identically, forever, from four lines of text. That property is what the whole cloud industry is built on.

   Any

   terraform destroy

Needs one other person who is not technical, and a real problem they actually have. That is the only requirement, and it is the hard part.

1. 1

   Find a real complaint

   Ask a family member, housemate or friend what annoys them about their computer or phone. Do not accept a technical description — you want the raw version. "It's slow." "The printer never works." "It keeps logging me out." That vagueness is the actual starting condition of the job.

2. 2

   Resist fixing it for ten minutes

   This is the discipline the whole trial is built around. Ask questions instead. When did it start? What changed around then? Does it happen every time, or sometimes? Show me. Watch them do it — you will almost always see something they did not mention, because they did not know it mattered.

3. 3

   Reproduce it yourself

   Make the problem happen on demand, with your own hands. If you cannot reproduce it, you cannot know you have fixed it — you can only know it has stopped happening for now, which is not the same thing and will come back.

4. 4

   Halve the problem, repeatedly

   Is it that app or all apps? That network or all networks? That account or all accounts? Each answer eliminates half of what it could be. Keep going until only one thing is left. Notice how few questions this actually takes when you choose them well.

5. 5

   Fix it — then explain it without jargon

   Make the fix. Then tell them what was wrong in language they understand, without being condescending and without pretending it was harder than it was. Watch their face. This skill is worth more to an early IT career than any certification, and almost nobody practises it deliberately.

6. 6

   Write the runbook

   Five lines: the symptom, how to confirm it is this and not something else, the fix, and how to tell it worked. Written so someone else could follow it at 3am without ringing you. This is the artefact that turns a fix into an asset.

A text editor and a browser. No install, no server, no account — the page runs from a file on your desktop.

1. 1

   Build something that works

   Save this as a file called app.html and open it in your browser. It is a greeting page that takes a name. Use it normally first — type your own name, see it work. Everything you build starts here: correct, for the input you imagined.

   Any

   <!doctype html>
   <input id="n" placeholder="your name">
   <button onclick="go()">Greet</button>
   <div id="out"></div>
   <script>
   function go() {
     const name = document.getElementById("n").value;
     document.getElementById("out").innerHTML = "Hello, " + name + "!";
   }
   </script>

2. 2

   Type something that is not a name

   Now put this in the box instead and press the button. Something will happen that the author did not intend and did not anticipate. You have just done the fundamental move of application security: supplying input the designer never pictured.

   Any

   <img src=x onerror="alert('this is now my page')">

3. 3

   Work out precisely why it worked

   The code never asked for code — it asked for a name. But it glued your text into the page as markup rather than as text, so the browser did what browsers do and executed it. Sit with that: the flaw is not the alert box, it is that data and instructions were allowed to occupy the same channel. Nearly every major vulnerability class is a variation of that one sentence.

4. 4

   Escalate it

   An alert box proves nothing to anyone. Change your payload so it reads something real from the page instead — the document title, a cookie you set yourself, the contents of another element. Proving actual impact rather than mere possibility is the difference between a finding a developer fixes and one they close as noise.

   Any

   <img src=x onerror="document.getElementById('out').textContent = document.title">

5. 5

   Fix it — the right way and the wrong way

   First fix it badly: filter out the word "script". Then defeat your own filter — the payload above never used that word. Now fix it properly by changing innerHTML to textContent, so the input is treated as text and can never be instructions. Try every payload again. This contrast, blocklist versus correct handling, is the single most useful lesson in the whole trial.

   Any

   document.getElementById("out").textContent = "Hello, " + name + "!";

6. 6

   Go looking for the same shape elsewhere

   Where else does something you have written take input and put it somewhere with meaning — a filename, a database query, a shell command, a URL? Write down three. You now have the pattern-recognition that application security work actually consists of, and it transfers to every language you will ever use.