Lab — Harden a Local Static Server

HOST must be the characters 127.0.0.1 inside the server file — not a variable you read from the command line, not a pasted LAN address, not “I will add a SAFETY flag later.” A flag you forget is how yesterday’s localhost clerk becomes today’s café listing. Print HOST on the first output line so the artifact is self-explaining. If HOST != "127.0.0.1", raise SystemExit. Bind 127.0.0.1 only (not 0.0.0.0). Pick a high port you own on this box (8000 in the template). Do not run as root. Do not serve $HOME, Documents, or a folder with secrets. Create $HOME/cyberlium-lab/webserver-root as the only tree. When notes are filled, Ctrl+C the server. Loopback binding is the control; stopping is the lockdown.

The client side of this lab is one or two GETs from the same machine: / should return 200 and your index; a directory path without an index should return 403 because YOU disabled listing. It is not a wordlist. It has no extra host. If 8000 is busy, pick another high port on loopback and write that port in the notes — still 127.0.0.1. Connection refused means start YOUR server first, still without aiming elsewhere. Seeing 200 plus 403 on loopback is the intended demo of a clerk YOU hardened.

SimpleHTTPRequestHandler on loopback is enough. Override list_directory so a folder request sends 403 and a tiny body instead of an HTML tree. Put index.html in the root so GET / is a page you authored, not a leftover vendor splash (Lesson 1). Do not copy SSH keys, mail, or password-manager exports into webserver-root. That is the whole policy. You are the server author saying no to listing — the same disable Lesson 1 named. You are not writing gobuster. You are not copying a web shell. You are not enabling CGI. If Python’s http.server feels small, that is the point: the skill is the HOST lock, the throwaway root, the 403, and the stop — not a framework.

Windows users: py harden_webserver.py in one PowerShell, then Invoke-WebRequest or py -c against 127.0.0.1 only in another. WSL and Git Bash can use the bash block as written. Record which OS you used. Do not point http.server at someone else’s files. Do not bind 0.0.0.0 “so the café can help.” Their hit from shared Wi-Fi is traffic at you and it trains the wrong muscle. Loopback only. Stop the server when notes are filled.

Required rows: legal line (original Cyberlium teaching mapped to the CEH v13 web-servers domain — not official EC-Council training, not a cert, not exam dumps); HOST = 127.0.0.1; bind 127.0.0.1; port; document root = cyberlium-lab/webserver-root; index.html present; listing disabled (403); Server token you actually saw; one access-style line you copied; lockdown Ctrl+C; ethics (no café, classmate, gobuster, dirb, ffuf, other IPs, no directory-listing homework on strangers); chmod reminder. Notes that list other people’s URLs fail ethics even if Python ran. World-writable 777 fails. If the server refused because you edited HOST, that refusal is a passing ethics check — put HOST back to 127.0.0.1 and rerun.

Failure modes that still pass if you tell the truth: forgot to start the server, connection refused, you start it and retry on loopback. Port in use — choose 8001 still on 127.0.0.1. Failure modes that fail the course: success against 10.x campus, HOST rewritten, listing homework on a classmate, notes chmod 644 on a shared PC, gobuster because 403 on loopback looked “too small.”

test -f "$HOME/cyberlium-lab/harden-www/index.html" && echo "index present"
test ! -f "$HOME/cyberlium-lab/harden-www/secret.txt" && echo "no secret.txt in web root (good)"

Follow the block. Terminal A: server. Terminal B: GETs to 127.0.0.1 only. Do not leave the server running unattended. When notes are filled, Ctrl+C. Windows notes sit at the bottom of the script comments.

Authorized lab only: YOUR process, YOUR folder, YOUR notes. Do not attack random hosts. Do not treat this file as permission to scan a shop’s hidden paths. Do not title it “Official CEH v13 web-server pwn.” If you already pointed a wordlist at a classmate, this lab does not launder that. Stop. Delete campaign drafts. This file is forward-looking hardening, not an indulgence.

sudo apt install curl

curl -sS -m 2 -o /dev/null -w "status=%{http_code}
" "http://127.0.0.1:8000/"
cat > "$NOTES" << 'EOF'
HOST: 127.0.0.1
INDEX: present
SECRET_IN_TREE: N
STOPPED: (Y)
ETHICS: not a stranger tree
EOF

You ran a real web-server hygiene demo without leaving loopback: hardcoded 127.0.0.1, a throwaway root, listing off, locked notes, server stopped. That is authorized server practice as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text, not a cert. Next — Quiz — Web Servers — ten APPLY items on leftovers, patch/modules/TLS/worker, logs on YOUR clerk, the HOST lock, and legal scope. Then Module 14: The App Is the Attack Surface — input, auth, session as a map, still no exploit pack.