Banners, Users, and Shares (Authorized Lab)

HTTP is the friendliest authorized banner in this module because you already used it in Topic 3 and Topic 7. You send a request; the server sends a status line and headers. HEAD (curl -I) asks for headers without a body. GET / does the same headers plus content. Among the headers, Server is the noisy one: it may say Python/3.x, Werkzeug, nginx/1.xx, Apache. Date, Content-Type, and Last-Modified are normal protocol fields, not “hacks.” X-Powered-By and similar extras are also nameplates. None of this is an exploit. On 127.0.0.1:8000 after python -m http.server, you should expect a SimpleHTTP family Server token. That is the lab. Copy the Server line into notes. Do not follow with a payload.

What HTTP enum is not: directory brute force against a site you do not own, credential stuffing /admin, or dumping cookies. What it is on your box: confirming the listener you started is the process you think it is, and noticing that the version token would later map to CVE literacy in Module 5. If Server is absent, that is also a finding for a defender — someone already hid the nameplate. Record “Server: (none)” honestly. Do not switch the curl target to a bank or a classmate “because theirs has a juicier header.” Loopback is the assignment.

sudo apt install curl
sudo apt install python3

brew install python3

curl -sS -m 2 -I "http://127.0.0.1:8000/" | grep -iE "HTTP/|Server:|Content-Type:|Date:"

SSH typically sends an identification string as soon as TCP connects, before password or key auth. On a lab VM you installed, that string might look like a protocol version plus a software family. That is a banner. Reading it on sshd you started is authorized enumeration. Pointing nc or an SSH client at a professor’s jumphost to “collect banners for the write-up” is not. This lesson does not require you to install OpenSSH or to parse identification strings in Python. HTTP Server is enough. The SSH paragraph exists so you are not surprised later: a greeting is not a shell, and a version is not a root exploit. Module 5 will say the same about CVEs.

Do not enable password auth on an internet-facing SSH “to practice enum.” Do not spray usernames. Do not run hydra. If you already have sshd on a VM you own, you may optionally note that a local ssh -V or a connection to 127.0.0.1:22 shows a greeting — still loopback, still your VM, still no brute force. If you do not have sshd, skip. Missing SSH does not fail this lesson. Inventing a campus target to “see a real banner” does fail ethics.

sudo apt install openssh-client

cat >> "$NOTES" << 'EOF'
ssh_greeting: protocol banner before auth — only on a daemon I run
refuse: ssh to cafe/campus/neighbor; hydra
EOF

SMB is how Windows (and Samba) share files. On a machine you administer, a misconfigured share might be guest-readable, named too honestly (Finance, Backups), or paired with an OS version that a scanner later maps to a CVE. Defenders care because exposed SMB on a network is a common path to data loss. Attackers care for the same reason — which is why this course will not hand you an SMB enum script aimed at anyone else. You will not run share-discovery against neighbors, printers you do not own, or campus AD. You will not exploit SMB. HTTP Server header on localhost is enough to practice the habit of reading a nameplate.

Users and shares as words in a CEH-shaped outline mean: services can leak identity (account names, share names) when they are configured to answer. On your own Windows lab VM, looking at Computer Management → Shared Folders is administration, not “hacking the LAN.” On someone else’s host, listing shares is enumeration of their data map. Keep the literacy; drop the target. If a tutorial says “enumerate SMB on the network segment,” that tutorial is not Cyberlium Module 4. Next lesson is the defender fix list: disable unused services, hide banners, least privilege — including “do not put SMB on the internet.”

cat >> "$NOTES" << 'EOF'
smb_means: named shares / OS clues on a box I administer
linux_note: no smbclient against strangers in this course
refuse: neighbor, cafe printer, campus file server
EOF

A version string is a hint. Module 5 will teach that a CVE ID is a named bug, and that a scanner matching a banner to a CVE is not automatic remote code execution. Still, banners are noisy because they make that matching easier: “this looks like unpatched software family X” is faster than guessing blindly. That is why defenders reduce banner detail (generic Server tokens, disable unused modules, do not run ancient daemons). That is why you should not publish your lab notes with a screenshot of a neighbor’s SMB. The noise is a defensive lesson, not an exploit pipeline.

Record what you saw, not what you wish you saw. If Python http.server says SimpleHTTP, write that. Do not upgrade it to “RCE confirmed.” Do not download a proof-of-concept because the header named a product. Do not scan the rest of the /24 for more Server headers. The noisy banner on localhost is the whole demonstration: identity leaked, no shell, no Metasploit, notes locked.

Start python -m http.server 8000 in a throwaway directory under cyberlium-lab if nothing is listening yet (Lesson 4 repeats this as a full lab). In another terminal, curl -I http://127.0.0.1:8000. If curl is missing, use Python http.client against 127.0.0.1 only, or PowerShell Invoke-WebRequest -Method Head. Fill banners-notes.txt. Stop the server when done if you started it. chmod 600.

sudo apt install curl
sudo apt install python3

brew install python3

cd "$HOME/cyberlium-lab"

python3 -m http.server 8000 --bind 127.0.0.1 || python -m http.server 8000

curl -sI http://127.0.0.1:8000

cat > banners_http_head.py << 'PY'
import http.client

HOST = "127.0.0.1"
PORT = 8000
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback banner grab")

conn = http.client.HTTPConnection(HOST, PORT, timeout=3)
try:
conn.request("HEAD", "/")
resp = conn.getresponse()
print("status:", resp.status, resp.reason)
for k, v in resp.getheaders():
    print(f"{k}: {v}")
    if k.lower() == "server":
        print("nameplate:", v)
except Exception as exc:
print("no listener yet or HEAD failed:", exc)
print("start python -m http.server 8000 --bind 127.0.0.1 in another terminal")
finally:
conn.close()
print("ethics: my HTTP only; no SMB exploit; no campus users/shares")
PY

python3 banners_http_head.py || python banners_http_head.py

{

You read a nameplate on a door you opened: HTTP Server on 127.0.0.1. You can explain, without running attacks, that SSH greetings and SMB shares can leak identity on systems you administer, and that those strings are noisy because they feed later vulnerability matching — not because they are shells. Next — What Defenders Lock Down After Enum — is the fix list: disable unused services, hide banners, least privilege. Still original Cyberlium teaching. Still not a Metasploit screenshot.