Ethical › Module 4 › Lesson 4
Lab — Enumerate a Service You Started
Start a local listener, read its banner, write notes — no campus or café targets.
Visual · enum_lab_localhost
Terminal A: python -m http.server bound to loopback. Terminal B: curl -I. Notes chmod 600. No campus, no café, no SMB.
Opening
You start the door. You read the nameplate. You lock the notes. That is the whole enum lab.
Lessons 1–3 split scan vs enum, named HTTP Server as enough banner practice, and wrote a lockdown ticket. This lab is the hands that match those words. You will create a throwaway folder under $HOME/cyberlium-lab, start python -m http.server 8000 bound to 127.0.0.1 if your Python allows it, run curl -I http://(or the Python/PowerShell equivalent), copy the Server header, fill enum-lab-notes.txt, chmod 600, then stop the server. You will not aim curl at campus, café, ISP, or a neighbor. You will not add SMB. You will not download an exploit because the header named SimpleHTTP. If 8000 is busy, pick another high port you choose and write that port in the notes — still loopback. If curl is missing, use the Python HEAD client from Lesson 2 or Invoke-WebRequest -Method Head. Empty notes fail. Notes that contain other people’s IPs fail ethics even if Python ran. Next is Quiz — Enumeration, then Module 5 (CVE literacy without exploit PoCs). This lab does not unlock Metasploit. It unlocks a locked file that says you enumerated a service you started.
1. Lab surface: throwaway root, loopback bind, HEAD only
Serve a directory you created for this lab, not your home directory and not a folder of other people’s files. A single index or a hello.txt you authored is enough. Binding 127.0.0.1 keeps the café from accidentally enumerating you. HEAD/curl -I retrieves headers without fetching a large body. You are proving you can read a nameplate, not load-testing the server. Do not add query strings, directory brute lists, or POST bodies. Do not enable directory listing as a stunt on a shared network. Loopback plus a tiny file is in scope.
Windows users: py -m http.server 8000 --bind 127.0.0.1 in PowerShell, then Invoke-WebRequest -Method Head http://127.0.0.1:8000 and inspect Headers. WSL and Git Bash can use the bash block as written. If --bind is unsupported on an ancient Python, still keep the lab on a machine that is not offering 8000 to untrusted networks, and stop the server immediately after the HEAD. Record which OS and which client you used so the notes are reproducible on YOUR box.
2. What to write: scan column, enum column, lockdown line, ethics line
Scan: 127.0.0.1:8000 OPEN while the server runs, then closed_or_filtered after Ctrl+C. Enum: HTTP status, Server header, any extra tokens, copied honestly. Lockdown: stop the process; do not leave it bound to 0.0.0.0; least privilege was already the throwaway folder. Ethics: service I started; no campus AD; no neighbor SMB; no café. Timestamp both OPEN and closed checks so the file shows you cleaned up. chmod 600 on the notes, the Python helper if you used one, and any hello.txt you do not want world-readable on a shared account.
Failure modes that still pass if you tell the truth: curl fails because you forgot to start the server — start it, retry, do not pivot to another IP. HEAD returns no Server header — write “(none)” and still stop the listener. Port 8000 in use by something else you own — identify YOUR process or choose 8001 and document it. Failure modes that fail the course: success against 10.x campus, smbclient, hydra, exploit gist, notes chmod 644 on a lab PC.
3. Wrong vs right: café/campus enum vs curl -I on a server YOU started
Worked failure — same curl -I, opposite URL. Right never needs a second host when loopback answers.
Wrong
curl -I the café gateway, a school intranet, or a neighbor’s 8000. Add smbclient -L. Leave http.server on 0.0.0.0 overnight. Paste headers plus foreign IPs into a group chat. Download a PoC because Server named a product. Skip chmod. Call the lab incomplete without a user list.
Right
python -m http.server 8000 --bind 127.0.0.1 in a folder you created. curl -I http://127.0.0.1:8000. Fill enum-lab-notes.txt with scan, enum, lockdown, ethics. chmod 600. Stop the server. Confirm closed. Next: Quiz — Enumeration.
4. Hands-on: start, HEAD, notes, chmod 600, stop, recheck
Follow the block in two terminals. Do not merge “start server” and “curl” in a way that leaves the server running unattended on a shared Wi-Fi. When the notes are filled, Ctrl+C the server and rerun the closed check.
Command guide
Scan column vs enum column — WHAT/WHY
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 2 -I "http://127.0.0.1:8000/" | head -n 12
Command — copy this
cat >> "$NOTES" << 'EOF' SCAN: OPEN or closed_or_filtered on 127.0.0.1:8000 ENUM: (Server / status from HEAD) LOCKDOWN: bind loopback; stop listener; no 0.0.0.0 ETHICS: no cafe/campus enum EOF
Mission: enum-lab-notes.txt — curl -I YOUR http.server, chmod 600
1) Start python -m http.server 8000 --bind 127.0.0.1 in $HOME/cyberlium-lab/enum-lab-root (or equivalent). curl -I http://127.0.0.1:8000 (or Python HEAD / Invoke-WebRequest). 2) Fill enum-lab-notes.txt: scan OPEN, Server header, lockdown (stop server), ethics line. chmod 600 notes, helper, hello.txt. 3) Stop the server. Recheck closed_or_filtered. Never campus, café, neighbor SMB, or exploit downloads.
Stuck? Ask Cyberlium AI Mentor
If “the lab is incomplete without SMB users” still feels true, ask for a hint — not a share list. Try: "Hint only: why curl -I http://127.0.0.1:8000 after I started http.server is the whole enumeration lab, why notes need chmod 600, and why campus/café/neighbor targets fail ethics?" You still fill the file. No smbclient. No /24 scan. No PoC.
You caused the door, read the nameplate, wrote both columns, locked the file, and closed the door. That is authorized enumeration as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text. Next — Quiz — Enumeration — ten APPLY items on scan vs enum, authorized banners, and the ethics line. Then Module 5: a CVE is a named bug; a scanner row is not automatic RCE; you will read a public advisory, not run an exploit.
Knowledge Check
APPLY: curl -I http://127.0.0.1:8000 after python -m http.server you started prints a Server header. What did the lab demonstrate, and what must you do next?
Multiple choice
Knowledge Check
APPLY: True or False: If loopback:8000 is closed, the ethical completion is smbclient against a neighbor and curl -I at campus until a banner appears.
True or False
Knowledge Check
APPLY: Which note file pairing matches this lab’s ethics and hygiene?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice