API › Module 1 › Lesson 3
Lab Bind: 127.0.0.1 Only
Teaching listeners bind loopback — prove 127.0.0.1:8810 never 0.0.0.0.
Visual · api_lab_bind_loopback
Bind = 127.0.0.1. Port 8810 this module. Original Cyberlium.
Opening
0.0.0.0 is not “easier for the phone.” It is every interface, including networks this course does not authorize.
RoE named the dest. This lesson names the socket. A teaching API that binds 127.0.0.1:8810 answers only on this host. The same code with 0.0.0.0:8810 advertises on Wi-Fi, Ethernet, and anything else that can route to you. Beginners call that convenience. Defenders call it accidental publication of a half-finished auth toy. Original Cyberlium. You will verify connect_ex to 127.0.0.1:8810 and refuse snippets that hardcode 0.0.0.0. You will NOT expose lab APIs to café clients, not hydra the bind, not sqlmap the LAN. Next: Scope Lab — API Surface Pack.
1. Loopback means this keyboard’s host only
127.0.0.1 is the address that always means “me.” Teaching ports for Topic 13 Module 1 live on 8810. Later modules use 8811–8814 for M2–M5. Memorize the habit: SAFE is loopback plus the module port.
If connect_ex fails, the lesson is still valid: write the bind rule before the listener exists. Do not “fix” a dead port by scanning 192.168.0.0/24.
Command guide
Try these commands — Loopback means this keyboard’s host only
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
Python http.server — https://docs.python.org/3/library/http.server.html (loopback bind only)
Binding safety — https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Terminal A — bind loopback ONLY (Ctrl+C to stop)
Command — copy this
python3 -m http.server 8810 --bind 127.0.0.1
Terminal B:
Command — copy this
curl -sS -D - -o /dev/null http://127.0.0.1:8810/
Primary tools to practice this lesson: python3, curl. Reference sites: Python http.server (https://docs.python.org/3/library/http.server.html); Binding safety (https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refuse 0.0.0.0 in every snippet
Many tutorials pass Host=0.0.0.0 so containers “work everywhere.” That pattern is wrong for Cyberlium labs. Rewrite to 127.0.0.1. If a classmate wants to hit your toy from their laptop, they start their own toy — they do not borrow your interface.
Firewall rules on the laptop are a second layer, not a license to publish. Bind policy is the first layer.
3. Ports are labels, not loot
8810–8814 are course labels so modules do not collide. They are not “interesting open ports” to hunt on other people. nmap for 8810 on the dorm is out of scope forever in this topic.
Ship a one-line note: bind=127.0.0.1 port=8810 never=0.0.0.0. Quiz and labs will reuse that sentence.
4. What you ship: a hard loopback bind rule for 8810
Document HOST=127.0.0.1 PORT=8810. Refuse 0.0.0.0. DEMO GATE done. No LAN scan for “open API ports.” chmod 600 note.
5. What you record before the next lesson
Date. Bind rule. connect_ex result or “listener not up yet.” NEVER 0.0.0.0, NEVER nmap /24. File t13-m01-l03-lab-bind.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
HTTPServer(("0.0.0.0", 8810)) so the class can share. nmap 192.168.0.0/24 looking for 8810. hydra anything because the port was closed.
Right
Write the bind rule. Probe only 127.0.0.1:8810. Next: Scope Lab — API Surface Pack.
Mission: freeze bind before you serve
1) / STOP if router. 2) Write HOST=127.0.0.1 PORT=8810 and a refuse-0.0.0.0 line. 3) Optionally connect_ex 127.0.0.1:8810 — do not scan the LAN. Never publish the teaching API.
Stuck? Ask Cyberlium AI Mentor
If the port is busy, ask Mentor how to find YOUR pid — not how to steal port 80 on a router.
Knowledge Check
APPLY: A lab snippet says HTTPServer(("0.0.0.0", 8810)). What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: nmap 192.168.0.0/24 is the right way to find which classmates started port 8810.
True or False
Knowledge Check
APPLY: Module 1 teaching port is:
Multiple choice