API › Module 1 › Lesson 4
Scope Lab — API Surface Pack
Pack RoE + bind + surface note — curl only 127.0.0.1:8810.
Visual · api_scope_lab
Lab: write surface pack. Bind 127.0.0.1:8810.
Opening
If the host is not in the pack, curl does not get it. That is the whole lab.
Lessons 1–3 defined API, wrote RoE, and locked the bind. This lab ships the artifact later modules will reuse: a surface pack naming YOUR teaching dest (127.0.0.1:8810), YOUR RoE stop lines, and a short inventory of methods/paths you intend to practice — not a target list of stranger SaaS. Original Cyberlium. Start YOUR loopback toy if the course provides one; curl it; record status lines. You will NOT sqlmap, hydra, or bind 0.0.0.0. Next: Quiz — API Surface and RoE.
1. Lab contract: GATE, then write the pack
GATE first. curl http://192.168.0.1/ — Router Admin means STOP. The rest of the lab is files under $HOME/cyberlium-lab and HTTP on 127.0.0.1:8810.
surface.yaml (or a plain.txt pack) lists dest, bind, never-list, and optional paths like /health. Empty paths are honest. A classmate’s staging URL is a fail.
Command guide
Try these commands — Lab contract: GATE, then write the pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Swagger OpenAPI — https://swagger.io/specification/ (map YOUR lab paths) Postman learning — https://learning.postman.com/ (collections against loopback)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
grep -i never "$HOME/cyberlium-lab/t13-api/roe.txt" 2>/dev/null || echo 'Write roe.txt first (lesson 1-2)' curl -sS -m 3 http://127.0.0.1:8810/openapi.json 2>/dev/null | head -c 400 || curl -sS -m 3 -I http://127.0.0.1:8810/
Primary tools to practice this lesson: curl, grep. Reference sites: Swagger OpenAPI (https://swagger.io/specification/); Postman learning (https://learning.postman.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Prove the dest YOU own
Start the Module 1 listener bound to 127.0.0.1:8810. curl -sS -D - http://127.0.0.1:8810/ and save status/headers. If the listener is not up yet, write “pending” — do not invent another host.
Grep your helper for 0.0.0.0. If present, fix before you continue. Classmates run their own lab.
3. Lock the proof and refuse hunting habits
Write t13-m01-l04-scope-lab.txt with date, DEMO GATE, bind proof, and “no stranger APIs.” chmod 600. Quiz is next.
Do not “enrich” the pack with Shodan hits or Google dorks for /api/v1. Enrichment without ownership is recon against others.
4. What you ship: surface pack, loopback curl, no stranger hosts
Pack names 127.0.0.1:8810 and NEVER lines. curl SAFE or honest pending. DEMO identified or STOPPED. chmod 600. No sqlmap/hydra. No 0.0.0.0.
5. What you record before the next lesson
Date. surface pack path. curl status from 127.0.0.1:8810. NEVER stranger SaaS, sqlmap, hydra, phishing OAuth. File t13-m01-l04-scope-lab.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
Add three public APIs “as practice.” Bind 0.0.0.0 so a phone can join. sqlmap the lab “to be thorough.”
Right
Write YOUR pack. curl 127.0.0.1:8810. chmod 600. Next: Quiz — API Surface and RoE.
Mission: freeze YOUR API surface on loopback
1) / STOP if router. 2) Write surface pack with dest 127.0.0.1:8810 and NEVER list. 3) Start YOUR toy on loopback and curl it (or note pending). 4) chmod 600. Never list stranger hosts. Never bind 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
If Python is missing, ask Mentor for a PATH hint — not for scanning the LAN for open 8810.
Knowledge Check
APPLY: The lab helper says bind 0.0.0.0:8810. What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: You should add a public weather API to the surface pack as a control.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is Huawei Router Admin during the scope lab. Next?
Multiple choice