API › Module 1 › Lesson 2
Rules of Engagement and Written Scope
If it is not written, it is not in scope — draft YOUR API RoE for 127.0.0.1:8810.
Visual · api_roe_written_scope
RoE is written who / what / stop. 127.0.0.1:8810. Original Cyberlium.
Opening
Curiosity is not authorization. A sentence in a file is.
Lesson 1 named the contract. This lesson names who may be called. Rules of Engagement (RoE) answer which hosts (127.0.0.1 and YOUR named lab), which tools (curl, YOUR toy servers — not sqlmap/hydra on strangers), where notes live ($HOME/cyberlium-lab), and when you stop (router admin, third-party SaaS, phishing kits, 0.0.0.0 binds). Original Cyberlium. DEMO http://192.168.0.1/ is YOUR lab app. , use 127.0.0.1:8810. You will draft RoE as a file you chmod 600 — not a verbal vibe. You will not copy a bug-bounty program and aim it at a school API. Next: Lab Bind: 127.0.0.1 Only.
1. Four RoE lines: who, what, where, stop
Who: APIs and listeners YOU started or a written lab names. What: read/write on those contracts with curl and course toys. Where: notes under $HOME/cyberlium-lab, mode 600. Stop: consumer router banners, stranger SaaS, sqlmap/hydra against unowned hosts, phishing OAuth kits, bind 0.0.0.0.
Written scope is how you refuse a classmate who says “hit my friend’s staging API for fun.” Fun is not a signature. If the host is not in YOUR file, it is out.
Command guide
Try these commands — Four RoE lines: who, what, where, stop
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP RoE — https://owasp.org/www-project-web-security-testing-guide/ (authorized scope only) API testing ethics — https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t13-api" printf 'in_scope: 127.0.0.1:8810-8819 never: stranger SaaS, sqlmap prod ' > "$HOME/cyberlium-lab/t13-api/roe.txt" chmod 600 "$HOME/cyberlium-lab/t13-api/roe.txt" curl -sS -m 2 -I http://127.0.0.1:8810/ 2>/dev/null | head -5 || echo 'Start YOUR stub on 127.0.0.1:8810 when ready'
Primary tools to practice this lesson: curl, mkdir. Reference sites: OWASP RoE (https://owasp.org/www-project-web-security-testing-guide/); API testing ethics (https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Authorization is not “I have Wi-Fi”
Paying for home internet does not authorize API probes on every device that answered DHCP. Owning a laptop does not authorize hydra on every /login you see. Scope is host-and-contract level: this listener is mine; that path is in the lab brief.
Bug-bounty programs publish their own RoE. Steal the ethic (write scope, respect stop) and leave their targets alone unless you are enrolled there under their rules — this course is not that enrollment.
3. Stop conditions you can say out loud
If a tool asks for a URL that is not 127.0.0.1 or YOUR named lab, you stop. If curl of 192.168.0.1 is a router, you stop using that host. If a “kit” wants to phish OAuth tokens, you stop and delete it. Those sentences belong in the file now.
Next lesson hardens the bind: teaching APIs listen on 127.0.0.1 only. RoE without a bind rule is a hope. Bind rule without RoE is still a hope. You want both.
4. What you ship: four written RoE lines and named stop conditions
who/what/where/stop on disk. DEMO GATE recorded. 127.0.0.1:8810 named. NEVER stranger APIs, sqlmap, hydra, phishing OAuth, 0.0.0.0. chmod 600.
5. What you record before the next lesson
Date. Four RoE lines. DEMO identified or STOPPED. SAFE 127.0.0.1:8810. File t13-m01-l02-roe-scope.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
Aim a public bug-bounty checklist at the school API. Keep RoE “in your head.” Allow 0.0.0.0 “just for the phone.”
Right
Write four lines. Name stop conditions. Next: Lab Bind: 127.0.0.1 Only.
Mission: freeze API RoE before any probe
1) / STOP if router. 2) Write who/what/where/stop in $HOME/cyberlium-lab. 3) Name 127.0.0.1:8810 and refuse stranger hosts. Never sqlmap/hydra. Never phishing kits.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor for a RoE template shape — not for a target list of public APIs.
Knowledge Check
APPLY: A classmate pastes a staging URL and says “practice BOLA.” Your RoE lists only 127.0.0.1:8810. You:
Multiple choice
Knowledge Check
APPLY: True or False: Owning the Wi-Fi password authorizes hydra against every device on the LAN.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is Netgear Router Admin during RoE drafting. Next?
Multiple choice