Ethical › Module 2 › Lesson 4
Lab — Footprint a Domain You Own
Collect public facts about YOUR domain or example.com into cyberlium-lab notes.
Visual · footprint_lab_notes
The lab artifact is $HOME/cyberlium-lab/ceh-footprint.txt mode 600 — public facts about example.com or a domain YOU own, not a stranger dossier.
Opening
The grade is a locked notes file of an allowed name — not a binder of other people’s secrets.
Lessons 1–3 gave you the map: passive pages, the active-permission switch, and public DNS/WHOIS. This lab is collation. You will create $HOME/cyberlium-lab/ceh-footprint.txt, fill it with dated public facts about example.com or a domain THE USER OWNS, and chmod 600. If you already have passive-recon-notes.txt and dns-whois-notes.txt, copy the rows in. If you skipped those files, run the lookups now — still only the allowed name. You will not add a shop, a school, or a neighbor to “make it impressive.” You will not Shodan. You will not dork logins. You will not AXFR. Success is a complete, boring file: domain, date, source, homepage status/title (optional one GET), A/NS/MX, WHOIS registrar/dates, ethics line. Empty files fail. World-writable 777 fails. Files that list other people’s staff fail ethics even if the data was on the web. This is original Cyberlium, not official CEH training. Next is the module quiz. After that, Module 3 scanning stays on 127.0.0.1.
1. What belongs in ceh-footprint.txt — and what never does
Required rows: (1) legal line — original Cyberlium lab, not an exam dump. (2) domain = example.com or YOUR domain. (3) UTC date. (4) why_allowed = designated example host or I own the registrar account. (5) passive: homepage title/status or “browser/GET skipped.” (6) DNS: A, NS, MX or “none published.” (7) WHOIS: registrar, dates, NS, contacts redacted. (8) ethics: no dorks of other logins, no Shodan-against-random, no neighbor, no café, no school, no AXFR on strangers. (9) scope reminder from Lesson 2: packets that probe need writing; this file is mostly public-record plus one optional GET. Optional: job-post note only if the careers page is on YOUR domain.
Forbidden rows: classmate emails, scraped directories, café portal screenshots, Shodan camera hits, nmap output, passwords, cookies, AXFR dumps, Google dork result lists aimed at third parties. If it would embarrass you in front of a judge or a registrar, it does not belong in cyberlium-lab. chmod 600 so other local accounts do not read it. Same path habit as Topics 2, 6, 7, 8.
Command guide
Footprint artifact columns — WHAT/WHY (what never belongs)
═══ COMMANDS ═══
Command — copy this
cat > "$NOTES" << 'EOF' === FOOTPRINT LAB (Cyberlium M02 L04) === DOMAIN: example.com DATE_UTC: SOURCE: one HEAD/GET or DNS (not a crawl) HOMEPAGE_TITLE_OR_STATUS: DNS_A_NS_MX: ETHICS: example.com or MY domain; no dorks; no Shodan; no neighbor EOF
2. How to collect without expanding scope
Order of operations: mkdir the lab folder; set DOMAIN=example.com (or your name); one optional GET; nslookup/dig; whois; write the file; chmod; read it back. If whois fails on Windows, use WSL or the registrar web page for that same allowed name only. If DNS fails, write the error and still keep the ethics lines — do not “fix” it by querying a more popular domain. If the GET times out, write timeout and stop; do not crawl. Carry Lesson 2’s card: you are not ping-sweeping, not port-scanning the domain’s A record (that is Module 3, and Module 3 is loopback). Looking up an A record is not permission to nmap that IP.
People confuse “I have an IP from DNS” with “I may scan it.” That confusion is how footprinting labs become unauthorized scans. Write explicitly: “A record noted; no scan of this IP in Module 2; Module 3 HOST stays 127.0.0.1.” If you own the domain and later have RoE to test YOUR servers, that is a different document on a different day. Not this file. Not café Wi-Fi.
Command guide
Collect without expanding scope — WHAT/WHY
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 8 -I "https://example.com/" | head -n 16
Command — copy this
nslookup -type=A example.com
3. Windows, Git Bash, WSL — same artifact, same mode 600
Native PowerShell: New-Item the folder under your profile (often $env:USERPROFILE\cyberlium-lab), Resolve-DnsName example.com, Out-File ceh-footprint.txt, then restrict the ACL or use Git Bash chmod 600. Git Bash/WSL/macOS/Linux: mkdir -p "$HOME/cyberlium-lab" and the script below. Do not email the file to a classmate for “grading” if it contains your registrar account hints. Do not put it on a public gist. The lab is local evidence that you stayed in scope.
If you own a domain, prefer it over example.com so you see YOUR publication. Still one name. Still no employee dossier. Still no AXFR unless you are querying a name server you administer on a network you own — and even then this lab does not require AXFR. Public A/NS/MX/WHOIS is enough.
4. Quality check before you call the lab done
Open the file. Confirm the domain is allowed. Confirm there is no second host. Confirm no personal emails of strangers. Confirm the ethics paragraph is present, not deleted to save time. Confirm mode 600 (or a tight Windows ACL). Confirm you did not paste nmap XML. If any check fails, edit and chmod again. A short honest file beats a long dirty one.
Useful failure: example.com WHOIS looks like documentation, not a company. That is correct. Write what you saw. Do not hunt a “realer” WHOIS. The quiz will test whether you know why example.com is enough.
5. Wrong vs right: stranger dossier vs locked ceh-footprint.txt
Worked failure — same notepad, opposite evidence. Right is a locked file about one allowed name.
Wrong
Add a local shop, school.edu, café portal, or neighbor blog because example.com was boring. Include Shodan hits, login dorks, AXFR, staff emails, nmap of the A record. chmod 777. Publish the file. Call it official CEH. This course is not that, and those rows are out of ethics.
Right
One domain: example.com or YOURS. Page fact optional. A/NS/MX. WHOIS registrar/dates. Ethics + “no scan of the A record in this module.” $HOME/cyberlium-lab/ceh-footprint.txt chmod 600. Next: Quiz — Footprinting, then scanning on 127.0.0.1 only.
6. Hands-on: build ceh-footprint.txt and lock it
Work top to bottom. The script writes a template and optionally runs DNS. Fill blanks by hand from your Lesson 1–3 output. Then chmod 600. Do not loop the domain list.
Mission: ceh-footprint.txt (mode 600) for one allowed name
1) Set domain to example.com or a domain YOU own. Collect optional page fact, DNS A/NS/MX, WHOIS registrar/dates. 2) Write $HOME/cyberlium-lab/ceh-footprint.txt with the ethics block (no dorks, no Shodan-against-random, no neighbor/café/school, no AXFR-on-random, no nmap of the A record). 3) chmod 600. Read the file back. Do not add a second host to look advanced.
Stuck? Ask Cyberlium AI Mentor
If the file feels “too small” without a shop or Shodan screenshot, ask for a hint — not a target. Try: "Hint only: which rows must be in ceh-footprint.txt for example.com or MY domain, why an A record is not a scan warrant, and why chmod 600 matters?" You still fill one name. No café. No school. No stranger AXFR.
You now have a single locked artifact that proves Module 2 stayed on an allowed name: public page optional, DNS and WHOIS required, ethics explicit, no scan of the published IP. That is footprinting as Cyberlium teaches it — original material, not EC-Council courseware. Next — Quiz — Footprinting — ten APPLY items on passive vs active and authorized scope. Then Module 3: Why Scans Happen, with HOST hardcoded to 127.0.0.1.
Knowledge Check
APPLY: DNS gave you an A record for example.com. A classmate says nmap that IP to finish the footprint lab. Correct move?
Multiple choice
Knowledge Check
APPLY: True or False: If example.com WHOIS looks like documentation, you should add a local shop and a school staff scrape so the file looks like a real pentest.
True or False
Knowledge Check
APPLY: Which artifact and mode complete the lab?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice