What a Web Server Exposes

A default page is the welcome file a product ships so the installer can prove the daemon started: “It works!”, a stock nginx page, an IIS splash, a framework sample. On a stack you run, that page is a finding because it tells a stranger the product family and that nobody finished setup. The defender move is boring: replace it with YOUR content, or return 404/403 on the leftover path, and do not leave sample apps in the document root. The tester move, when you have written RoE on a host you are hired to review, is to note “default content still present” as a ticket — Module 5’s treatment shape, not a screenshot contest. This course does not assign hunting default pages on the public internet. A search engine query for leftover splash pages is not Lesson 1 and is not Lesson 4.

python -m http.server does not ship an “It works!” billboard, but it will happily serve whatever you pointed it at — including a home folder full of secrets if you started it in the wrong directory. That is the beginner default-page cousin: serving the wrong tree. Lesson 4 will force a throwaway folder under cyberlium-lab with an index.html YOU wrote. Until then, the literacy sentence is: leftover vendor pages and leftover sample trees are exposures you remove on systems you administer. Skill does not create consent to catalog other people’s leftovers. A cert acronym in a blog title is not a warrant.

cat >> "$NOTES" << 'EOF'
default_pages: I will serve MY index, not a vendor sample
refuse: google dork inurl:admin on strangers
EOF

Directory listing is the daemon printing a file tree when a folder has no index document. Python’s SimpleHTTPRequestHandler does this by default. Apache autoindex, nginx autoindex, and “Indexes” options are the same idea on products you might run later. On YOUR listener, seeing a listing means you forgot an index or you left autoindex on — a hygiene miss, not a trophy. The fix is an index file, or a handler that refuses to list (Lesson 4 overrides list_directory to 403 on a server YOU wrote). The wrong next step is a directory brute-force against a host you do not own: gobuster, dirb, ffuf, a wordlist of /admin /backup /git, pointed at a shop or a classmate. That is unauthorized enumeration of someone else’s data map. Module 4 already refused neighbor SMB. This module refuses stranger directory brute the same way.

A useful failure: “I need a real site or I cannot learn listing.” You can learn it on loopback the moment you start http.server in a folder without index.html — and then you put the index in so the tree stops advertising. Brute-forcing school.edu “because the listing is off and I need to find hidden paths” is not this course. Hidden-path hunting on a stranger is still enumeration without permission. If a later employer gives you written RoE that names a host and a method, that writing — not this lesson — is the authorization. You do not have RoE for the café, the campus CMS, or a random SaaS. Write the refuse line before you write any tool name.

sudo apt install curl
sudo apt install python3
sudo apt install gobuster

brew install python3
brew install gobuster

go install github.com/OJ/gobuster/v3@latest

curl -sS -m 2 -I "http://127.0.0.1:8000/" | head

HTTP often returns a Server header. On python http.server you should expect a SimpleHTTP family token. Production daemons may print product and version. Module 4 called that a nameplate: it shrinks later CVE matching and it is noisy. An outdated banner is the same nameplate after the vendor has shipped fixes you did not apply. Literacy is: record the token on a listener YOU started; treat it as a patch ticket, not as remote code execution. Module 5 already refused exploit clones. Hiding or genericizing the token (Lesson 2) is a cost-increase, not a substitute for patching. Downloading a proof-of-concept because a header named Apache is the failure mode this heading exists to kill.

What a banner is not: a shell, a user list, permission to scan the /24 for more Server headers, or a reason to point curl at a bank. If Server is absent, write “Server: (none)” honestly — someone already hid the plate, and the software can still be old. Do not switch the target to a juicier public host. Loopback is enough to see that a listener volunteers identity. Lesson 4 will let you copy the Server line from 127.0.0.1 into ceh-webserver-lab.txt. Until then, a filled definition file is a complete Lesson 1. Do not add a second host because localhost felt small.

sudo apt install curl

curl -sS -m 2 -I "http://127.0.0.1:8000/" | grep -i Server
cat >> "$NOTES" << 'EOF'
banner: nameplate — patch MY software
refuse: exploit a stranger Server token
EOF

A web-server exposure note is boring on purpose. Date (UTC). Default page: leftover vendor/sample content you would remove on a stack you administer. Directory listing: a tree the daemon prints when index is missing — disable on YOUR servers; never wordlist strangers. Outdated banner: a version token that belongs in a patch ticket, not an exploit search. Ethics: audit a stack YOU run; no attacking random hosts; no directory brute of strangers; no gobuster/dirb/ffuf at café/classmate/campus; no default-page dorking as homework. Legal line: original Cyberlium teaching mapped to the CEH v13 web-servers domain — not official EC-Council training, not a cert, not exam dumps. Path: $HOME/cyberlium-lab/web-server-exposes-notes.txt, chmod 600. Empty files fail. Files that list victim URLs fail even if you “only planned.” World-readable 777 fails.

A useful feeling: the lesson is “too small” because you did not knock on a live site. That feeling is how people graduate into unauthorized web scans. The skill is stopping at names. Lesson 4 will let you see listing, an index, a bind to 127.0.0.1, and a Server token on a listener YOU started — then you stop the server. Until then, locked definitions are complete. Do not paste gobuster command lines into the notes as “research.” Do not gist other people’s hostnames.

On a computer you own, create cyberlium-lab if needed. Fill the template in your own words. Do not add a wordlist. Do not add a host that is not a definition. chmod 600. The block below writes the file and refuses to become a directory-brute kit — there is no gobuster, no extra host, no dork query.

sudo apt install gobuster

brew install gobuster

go install github.com/OJ/gobuster/v3@latest

cd "$HOME/cyberlium-lab"

{

You now treat a web server as a clerk that can volunteer leftovers — default pages, a file tree, a version token — and you treat gobuster-against-strangers, default-page dorking, and random-host attacks as out of this course. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 web-servers domain — not official EC-Council training, not a cert, not exam dumps. Next — Patching and Least Modules — unused modules, TLS, and a worker that is not root, still on a stack you run.