Ethical › Module 10 › Lesson 4
Lab — Rate-Limit a Local Demo Server
Your http.server + a tiny client loop on localhost — never the internet.
Visual · ratelimit_localhost_lab
HOST hardcoded 127.0.0.1. You write a tiny limiter that returns 429. A polite ~20 GET loop talks only to YOUR listener. Notes chmod 600. Never the internet.
Opening
You hardcode loopback. You write the 429. You send a tiny polite loop at YOUR listener. You lock the notes. That is the whole availability lab.
Lessons 1–3 named exhaustion, stolen IoT, and defender controls (rate limits, anycast, upstream help) without a flood recipe. This lab is the hands that match “rate limit”: a short Python HTTP server bound to 127.0.0.1 that returns 429 Too Many Requests after N GETs in a one-second window, plus a client that issues about twenty GETs to that same HOST only. You will write both files with HOST = "127.0.0.1" hardcoded. You will refuse to run if HOST is anything else. You will fill $HOME/cyberlium-lab/ceh-ratelimit-lab.txt and chmod 600. You will not change HOST to argv, a café gateway, a classmate, a cloud IP, or “the internet for one packet.” You will not import LOIC. You will not add hping. You will not thread a thousand workers. You will not point the loop at any other IP. A tiny sequential loop with a short sleep is polite on purpose — this is a limiter demo, not a cannon. This is original Cyberlium teaching mapped to the CEH v13 denial-of-service domain — not official EC-Council training, not a cert, not exam dumps. Next is Quiz — Denial-of-Service, then Module 11 talks session tokens conceptually (cookies, HTTPS, HttpOnly) — still no hijack PoC.
1. Lab surface: HOST string frozen, YOUR listener, tiny polite loop
HOST must be the characters 127.0.0.1 inside both files — not a variable you read from the command line, not a pasted LAN address, not “I will add a SAFETY flag later.” A flag you forget is how yesterday’s localhost tool becomes today’s café loop. Print HOST on the first output line so the artifact is self-explaining. If HOST != "127.0.0.1", raise SystemExit. Bind the server to 127.0.0.1 only (not 0.0.0.0). Pick a high port you own on this box (8765 in the template). Do not run as root. Do not leave the server running unattended on shared Wi-Fi — loopback binding is the control, and Ctrl+C is the lockdown.
The client is sequential: about twenty GETs, a short sleep between them, count of 200 versus 429, then exit. It is not a flood tool. It has no thread pool, no IP rotation, no extra host. If 8765 is busy, pick another high port on loopback and write that port in the notes — still 127.0.0.1. Empty 429 (every response 200) means your N is too high or your sleep is too long; lower N or shorten sleep on THIS listener, still without aiming elsewhere. Seeing some 429s is the intended demo of a limiter YOU wrote.
Command guide
Tiny polite loop on YOUR listener — WHAT/WHY
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
HOST, PORT, N = '127.0.0.1', 8000, 5
assert HOST == '127.0.0.1'
print('plan: at most', N, 'GETs to', HOST, PORT, '— polite, then stop')
print('REFUSE: thousands of sockets, hping, strangers')
PY2. The limiter YOU wrote: N per second, then HTTP 429
BaseHTTPRequestHandler on loopback is enough. Keep a short deque of monotonic timestamps. On each GET, drop hits older than one second. If the remaining count is already N (5 in the template), send 429 plus a Retry-After header and a tiny body. Otherwise append now and send 200. That is the whole policy. You are the server author saying no — the same 429 Lesson 3 named. You are not writing Slowloris, a SYN generator, or a UDP amplifier. You are not copying a stresser. If Python’s http.server feels small, that is the point: the skill is the policy and the HOST lock, not a framework.
Windows users: py ratelimit_server.py in one PowerShell, py ratelimit_client.py in another. WSL and Git Bash can use the bash block as written. Record which OS you used. Do not point http.server at someone else’s files. Do not bind 0.0.0.0 “so a friend can hit my limiter.” Their hit from the café is traffic at you on a shared network and it trains the wrong muscle. Loopback only. Stop the server when notes are filled.
3. The artifact: ceh-ratelimit-lab.txt mode 600 — 429 you caused, not a trophy of strangers
Required rows: legal line (original Cyberlium teaching mapped to the CEH v13 denial-of-service domain — not official EC-Council training, not a cert, not exam dumps); HOST = 127.0.0.1; port; N per second; client GET count (~20); sleep; counts of 200 and 429; bind address 127.0.0.1; lockdown Ctrl+C; ethics (no café, classmate, LOIC, hping, other IPs); chmod reminder. Notes that list other people’s IPs fail ethics even if Python ran. World-writable 777 fails. If the client refused because you edited HOST, that refusal is a passing ethics check — put HOST back to 127.0.0.1 and rerun.
Failure modes that still pass if you tell the truth: forgot to start the server, connection refused, you start it and retry on loopback. Port in use — choose 8766 still on 127.0.0.1. Failure modes that fail the course: success against 10.x campus, HOST rewritten, loop aimed at a classmate, notes chmod 644 on a shared PC, LOIC because 429 looked “too small.”
4. Wrong vs right: flooding others vs hardcoded 127.0.0.1 plus a limiter YOU wrote
Worked failure — same word “rate limit,” opposite target. Right never needs a second host when loopback can answer 429.
Wrong
HOST = café, campus, classmate, cloud, or sys.argv. Point the loop at any other IP. LOIC, hping flood, thread bombs. Leave the server on 0.0.0.0. Skip chmod. Call the lab incomplete without a stranger’s outage. This course is not official CEH training and does not grade that hunt.
Right
HOST hardcoded "127.0.0.1" in server and client; refuse otherwise. Bind loopback. Limiter returns 429 after N/sec. Tiny polite ~20 GET loop at YOUR listener only. Fill ceh-ratelimit-lab.txt, chmod 600 under $HOME/cyberlium-lab. Ctrl+C the server. Next: Quiz — Denial-of-Service.
5. Hands-on: two terminals, limiter, polite loop, notes, chmod 600, stop
Follow the block. Terminal A: server. Terminal B: client. Do not merge them in a way that leaves the server running unattended. When notes are filled, Ctrl+C the server. Windows notes sit at the bottom of the script comments.
Command guide
429 you caused — WHAT/WHY then lock
═══ COMMANDS ═══
Command — copy this
cat > "$NOTES" << 'EOF' HOST: 127.0.0.1 N: (tiny) SAW_429: (Y/N after MY limiter) ETHICS: no floods of others EOF
Mission: ceh-ratelimit-lab.txt — hardcoded 127.0.0.1 limiter, chmod 600
1) Save ratelimit_server.py and ratelimit_client.py with HOST = "127.0.0.1" hardcoded and a refuse if HOST is anything else. Bind loopback. Limiter returns 429 after N/sec. 2) Start the server, run the tiny polite ~20 GET loop at YOUR listener only, fill $HOME/cyberlium-lab/ceh-ratelimit-lab.txt, chmod 600, Ctrl+C the server. 3) Ethics: never point the loop at any other IP. No café, classmate, LOIC, or hping. Original Cyberlium teaching, not official CEH training, not a cert.
Stuck? Ask Cyberlium AI Mentor
If “the lab is incomplete without traffic at a real site” still feels true, ask for a hint — not a target. Try: "Hint only: why HOST must stay hardcoded 127.0.0.1, how MY handler returns 429 after N per second, why ~20 polite GETs are enough, and why café/classmate/LOIC/hping fail ethics?" You still fill ceh-ratelimit-lab.txt. No argv HOST. No other IP.
You ran a real rate-limit demo without leaving loopback: hardcoded 127.0.0.1, a limiter YOU wrote, a tiny polite client loop, locked notes, server stopped. That is authorized availability practice as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text, not a cert. Next — Quiz — Denial-of-Service — ten APPLY items on named buckets, botnets as defender inventory, 429/anycast/upstream help, the HOST lock, and legal scope. Then Module 11: What a Session Token Is — cookies, HTTPS, HttpOnly as concepts, still no hijack PoC.
Knowledge Check
APPLY: You started the limiter and the client reports connection refused. What is the ethical completion, and what is not?
Multiple choice
Knowledge Check
APPLY: True or False: If loopback is boring, the ethical lab is a small SYN flood of campus plus the client loop aimed at a cloud IP.
True or False
Knowledge Check
APPLY: Which note file pairing matches this lab’s ethics and hygiene?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice