Lab — Map Routes on an App You Own

If you map an existing project, you read code you already have: routes.py, urls.py, a Flutter or Express router, an OpenAPI file YOU generated. You do not discover routes by firing a fuzzer at a live hostname you do not operate. Production secrets do not go in the map. Use path patterns (/invoices/:id) not live invoice numbers from customers. If you do not have a project, use the demo: HOST must be the characters 127.0.0.1 inside the server file — not argv, not a LAN IP, not “I will bind 0.0.0.0 so a friend can map too.” If HOST != "127.0.0.1", raise SystemExit. Bind loopback only. High port 8766 in the template. Do not run as root. Ctrl+C when the map is filled.

Print HOST on the first output line so the artifact is self-explaining. Windows: py route_demo.py in PowerShell. WSL and Git Bash can use the bash block. Record which OS you used. Do not leave the demo on café Wi-Fi bound to all interfaces. Loopback binding is the control.

cat > "$NOTES" << 'EOF'
=== ROUTE MAP (Cyberlium M14 L04) ===
METHOD PATH AUTHN AUTHZ
GET / (fill) (fill)
ETHICS: MY app or 127.0.0.1 only
EOF

Required keys in app-route-map.txt: DISCLAIMER, HOST_OR_APP, ROUTE rows (at least four), AUTHN, AUTHZ, FIX_POINTER, ETHICS. Each ROUTE line names GET/POST/PUT/DELETE, a path, whether authentication is none or session (or your app’s real scheme), and whether authorization is public, owner, or role. The demo exposes /health (none/public), /login (none/public form — no stuffing homework), /me (session / self), /admin (session + role admin), POST otes (session / owner). You copy those facts into the notes. You do not try to bypass /admin. You do not send crafted bodies. Mapping is reading the table.

FIX_POINTER must say validation/encoding/server authZ from Lesson 3, and that SQLi/XSS depth lives in Topic 10 / Module 15. DISCLAIMER must include the Cyberlium legal sentence. ETHICS must refuse random sites, public DVWA, and unread bounty. The checker fails if placeholders remain, if sqlmap or payload-shopping phrases appear, or if the disclaimer omits that this is not official EC-Council training.

Required rows also include: legal line (original Cyberlium teaching mapped to the CEH v13 web-applications domain — not official EC-Council training, not a cert, not exam dumps); HOST 127.0.0.1 or “MY project <name>”; bind 127.0.0.1 if demo; lockdown Ctrl+C; chmod reminder. Notes that list school.edu, a café portal, or a public DVWA fail ethics even if Python ran. World-writable 777 fails. If the demo refused because you edited HOST, that refusal is a passing ethics check — put HOST back to 127.0.0.1 and rerun, or map YOUR repo instead.

Failure modes that still pass if you tell the truth: forgot to start the demo, connection refused, you start it and read /__routes on loopback. Port in use — choose 8767 still on 127.0.0.1. Failure modes that fail the course: gobuster against campus, HOST rewritten, map of a classmate API, notes chmod 644 on a shared PC, payload section “for later.”

Follow the block. If you already have a project, you may skip starting the demo and still fill the same keys from YOUR router. If you use the demo: Terminal A server, then GET http://127.0.0.1:8766/__routes in a browser YOU opened on this machine, or curl to loopback only. When notes pass the checker, Ctrl+C the server. Windows notes sit at the bottom of the script comments.

grep -E "METHOD|AUTHN|AUTHZ|ETHICS" "$NOTES"; chmod 600 "$NOTES"

You built a real methodology artifact without leaving ownership: YOUR routes or hardcoded 127.0.0.1, four lanes visible as columns, locked notes, demo stopped. That is authorized application practice as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text, not a cert. Next — Quiz — Web Applications — ten APPLY items on lanes, scope, bounty policy, local DVWA, fix patterns, the HOST lock, and legal mapping. Then Module 15: Why String-Built SQL Breaks — still no live SQLi against others; Topic 10 remains the deep lab path.