Authorized Testing vs Random Sites

Module 1 already said skill does not create consent. Application testing does not get a special exception because HTTP is easy to send. If you cannot name the owner and the writing that lets you test, you do not test. YOUR project — a repo you maintain, an API you deployed to a box you control — is in default scope for mapping and for fix work. A tiny http.server or framework demo YOU start on 127.0.0.1 is in default scope for Lesson 4. A production site whose only relationship to you is “I have an account” is not in scope. Customer-of-the-service is not tester-of-the-service. Logging in as yourself and then fuzzing another tenant is still unauthorized access.

Write it in one sentence you could read to a lawyer: I test applications I own, labs I run locally, or programs whose policy I read. I do not test random sites. Original Cyberlium teaching mapped to the CEH v13 web-applications domain is not a warrant, not official EC-Council training, not a cert, not exam dumps. “I was practicing Module 14” is not a defense.

test -f "$HOME/cyberlium-lab/ceh-roe.txt" && echo "RoE present"
cat >> "$NOTES" << 'EOF'
default_scope: MY app, 127.0.0.1 demo, written RoE
not_scope: it has a form
EOF

A public bounty is not “the company said anyone may hack us.” It is a contract-shaped page: in-scope hosts and apps, out-of-scope (often DoS, social engineering, physical, third-party SaaS, rate-limit games), data-handling rules, disclosure, and sometimes a safe-harbor paragraph that only applies if you stay inside that page. Authorized testing versus random sites means you open that page and can quote the asset and the forbidden actions before you fire a proxy. If you did not read it, you are not “on the bounty.” You are guessing. Guessing is how people hit out-of-scope admin panels, flood login (Module 10 already forbade that), or test a marketing WordPress that was never listed.

This course does not assign a bounty. It does not name a platform as homework. If you later choose a program, you still default to YOUR app until the policy is in your notes: program name, asset, OOS list, “I read this on DATE.” Empty “I will hunt on HackerOne tonight” fails this lesson. Bounty is optional and gated. Local demo is the assigned default. Do not treat a brand’s marketing site as in-scope because their engineering app is in-scope. The policy decides, not your curiosity.

Intentionally vulnerable apps exist so you can break something whose owner is you. DVWA, OWASP Juice Shop, and WebGoat are names of those labs. The ethical copy is the one YOU installed in YOUR VM, YOUR Docker on YOUR machine, bound to localhost or a private lab net you own. The unethical copy is a Google result titled “online DVWA” on an IP you do not control. That operator did not hire you. Other students may be using it. Attacking it is attacking someone else’s computer that happens to run vulnerable software. Vulnerable ≠ consent. Public demo ≠ RoE.

If you do not want to install a lab, you still complete this module on YOUR app or the Lesson 4 localhost route map. You are not required to run DVWA. You are required not to attack a public copy. Do not port-scan the internet looking for default DVWA pages. Do not share a classmate’s lab URL as a group target. Their VM on café Wi-Fi is not your playground. Bind labs to 127.0.0.1 when you can — Module 13 already used that bind for a reason.

A scope note is a gate. Date (UTC). Default: MY app / local demo. Bounty: only if I read the policy — program, asset, OOS, date read — otherwise NONE. DVWA/Juice/WebGoat: installed by me locally, or NOT USED. Never: public DVWA, school, café, classmate, random SaaS. Legal line: original Cyberlium teaching mapped to the CEH v13 web-applications domain — not official EC-Council training, not a cert, not exam dumps. File: $HOME/cyberlium-lab/authorized-scope-notes.txt, chmod 600. Notes that list stranger hostnames as “practice” fail ethics even if you have not sent a request yet. World-writable 777 fails.

Do not fill the bounty row with a brand you have not opened a policy for. Do not add sqlmap command lines. Next lesson writes fix patterns (validation, encoding, authorization on the server) so the methodology stays builder-first. Topic 10 remains the deep injection/XSS path — still on surfaces you are allowed to touch.

On a computer you own, create cyberlium-lab if needed. Fill the gate in YOUR words. Run the checker; it only reads YOUR file. chmod 600. Do not add a public hostname because the bounty row felt empty.

cat >> "$NOTES" << 'EOF'
allowed_vuln_apps: only if I run them on 127.0.0.1 / MY VM
public_copies: still strangers
EOF

You now treat application testing as a gated activity: YOUR app, a lab YOU run, or a bounty policy YOU read. Public DVWA copies, unread programs, and random sites are out. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 web-applications domain — not official EC-Council training, not a cert, not exam dumps. Next — Fix Patterns Before Payloads — validation, encoding, and authorization on the server, still pointing SQLi/XSS depth at Topic 10.