What Ethical Hacking Means

Unauthorized access is a crime in most jurisdictions even when you “meant well,” even when you found a real bug, even when the host had a default password. Ethical hacking, as this course uses the term, begins when a person or legal entity with authority over the target writes down what you may do. That writing can be a contract, a statement of work, a bug bounty policy you actually read, or — for this curriculum — a personal rules file that names only systems you own. Verbal “sure, poke around” from a friend who does not own the company is not permission. A job title is not permission to test production after hours. A YouTube lab that used a public IP is not permission to reuse that IP.

In this path the default authorized surface is narrow on purpose: computers and virtual machines you own or rent in your name, loopback (127.0.0.1), and files under $HOME/cyberlium-lab that you created. example.com appears later only as a public documentation host for reads a browser already performs (certificates, public DNS), never as a box to exploit. School networks, cafe Wi-Fi clients, a neighbor’s router, an employer’s SaaS tenant, and “random /24 to practice nmap” are out unless a signed document from the owner says otherwise — and Cyberlium never assigns you to obtain that document by scanning first. Permission is obtained before packets, not after a cool screenshot.

Write names, not vibes. “My homelab” is too vague if you share a house. “The Debian VM whose MAC I control, bridged only to a host-only network, hostname cyberlium-lab-vm” is a target. “The web app I cloned into a local Docker compose on localhost:8080” is a target. “The university login portal” is not. If you cannot point at an owner and a sentence they would recognize, you do not have a target. You have a wish. Wishes do not survive incident response, ISP complaints, or a prosecutor. This lesson’s notes file is where you practice writing the owner sentence before any later module tempts you with a scanner.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat >> "$NOTES" << 'EOF'
heading: permission is the switch
owner: (I own this machine / VM — fill a name they would recognize)
assets: 127.0.0.1 ; files under cyberlium-lab ; DEMO only if MY lab app
demo_url: http://192.168.0.1/  (STOP if router admin)
refuse: cafe, campus, neighbor, nmap /24, hydra, verbal-only permission
EOF

Permission without defender intent is still a problem. A contractor who is authorized to test payroll and then emails themselves a spreadsheet of salaries is not an ethical hacker; they are an insider incident. Intent here means: you are employed (including self-employed on your own lab) to discover how confidentiality, integrity, or availability could fail, then you document it so the owner can decide. Topic 1 already named the CIA triad. Ethical hacking is not a third triad. It is a way of stress-testing those three properties with the owner’s knowledge.

Defender intent also limits what you keep. You do not stockpile customer data “as proof.” You do not clone mailboxes. You do not leave a backdoor “so the retest is faster” unless the written rules explicitly allow a temporary account the owner can disable. In a home lab, intent looks like: I will break my own deliberately vulnerable app, write what failed, patch or note the control, chmod 600 the notes, and never point the same script at a classmate. Bragging screenshots of other people’s admin panels are evidence of the wrong intent even if a tool ran cleanly.

Movie hacking skips both switches. The protagonist “gets in” because the plot needs a win. Real authorized testing is often a spreadsheet of URLs, a freeze window, a call tree if you knock over staging, and a report that bores anyone who wanted explosions. That boredom is the point. This course will keep giving you maps, notes, and labs on YOUR machines. It will not give you a kit to impress a group chat. If a technique only makes sense as harm to a stranger, it is not a Cyberlium exercise even when the professional domain later names that technique as something defenders must detect.

sudo apt install curl

cat >> "$NOTES" << 'EOF'
intent: discover CIA failures, write them, leave (or patch MY lab)
not_intent: steal payroll, clone mailboxes, keep customer data as trophies
home_lab_looks_like: break MY vulnerable app, write what failed, chmod 600
EOF

CEH v13 is a well-known industry syllabus brand covering a sequence of security-testing domains (introduction, footprinting, scanning, and so on). Cyberlium Topic 9 walks a parallel domain sequence with original teaching. Mapping means: when professionals talk about “module 1” as the ethics-and-scope front door, you will have had that front door here — permission, intent, a shared phase map, contracts and rules of engagement, then a lab where you write rules for YOUR lab. Mapping does not mean we reproduced anyone’s slides, labs, question bank, or trademarked phrasing. You should never paste this app into an exam window and expect it to be “the” test.

Completing Cyberlium does not make you Certified Ethical Hacker, does not enroll you with EC-Council, and does not replace their official training, vouchers, or proctored exam. If you later choose an official path, that is a separate purchase and a separate legal agreement with that vendor. Treat any claim that “Cyberlium is secret CEH” as a lie. Treat any file in this topic that asked you to attack a live stranger as a file you should not have followed — because we will not ask that. AI helpers in this app (including the mentor tip) are for hints on YOUR notes, not for generating exploit chains against third parties.

You already hold the prerequisites this introduction expects: CIA and threat-actor literacy (Topic 1), a Linux lab habit (Topic 2), packets and ports (Topic 3), personal OSINT hygiene (Topic 4), phishing as a human control failure (Topic 5), mobile install distrust (Topic 6), Python on files you own (Topic 7), and crypto as integrity and lockboxes (Topic 8). Ethical hacking is not a reboot that throws those away. It is the permission wrapper around the same primitives. A hash of YOUR file is still integrity. nmap against a VM you built is a later module’s problem, still inside a written scope. Python that writes ceh-ethics-notes.txt is in scope today. Python that sprays a neighborhood is never in scope.

cat >> "$NOTES" << 'EOF'
legal: original Cyberlium teaching mapped to a CEH v13 domain
not: official EC-Council training, exam dump, or a credential
completing_this: does NOT grant CEH
EOF

Public conversation sorts people into “white hat,” “black hat,” and “grey hat.” Those labels are informal. They are not a license class. A so-called white hat who scans a hospital without a contract is still unauthorized. A researcher who follows a posted bounty policy is authorized even if someone on a forum calls them grey. Cyberlium will not quiz you on costume colors as if they were law. We will quiz you on: who owns the asset, what writing exists, what you intended to do with the findings, and whether your notes stayed in cyberlium-lab.

Topic 1 already separated script kiddies, insiders, criminals, and nation-state capacity as threat-actor sketches. Those sketches help a defender guess motive and resources. They do not grant you those motives. You are not assigned to roleplay a criminal except as a thought experiment: “if I were defending this box, what would I expect an uninvited person to try?” That sentence is how the five-phase map in the next lesson will be introduced — as detection opportunities, not as a shopping list. State-level operations, ransomware crews, and hacktivist defacement are things you study so you can recognize harm. They are not labs.

Information security work around this domain also includes vulnerability management, security operations, and incident response. Authorized testers are one role. Many learners here will never hold a penetration-test job and will still need the permission reflex: do not test what you do not own. A developer who runs a scanner on localhost before a release is doing ethical security work. A developer who runs the same scanner on a customer’s production “to help” without a ticket is gambling with their career. Keep the reflex even when the tool is boring.

On a computer you own, create $HOME/cyberlium-lab if it is missing. Run the block below (Git Bash, WSL, or a Unix shell). It writes ceh-ethics-notes.txt with prompts you must fill in your own words: owner sentence, authorized assets, forbidden examples, the legal disclaimer in one paragraph, and the ethics line. Empty notes fail. Notes that list a classmate’s host as a target fail ethics even if the file is mode 600. Do not add a port scan “to make it real.” chmod 600 when you finish. Windows without chmod: restrict the file ACL in your profile or use WSL.

cd "$HOME/cyberlium-lab"

cat > "$NOTES" << 'EOF'
=== CYBERLIUM ETHICAL HACKING — MODULE 1 LESSON 1 ===
disclaimer: This is original Cyberlium curriculum mapped to the CEH v13
introduction domain. It is NOT official EC-Council training, NOT a CEH
exam dump, and completing it does NOT grant CEH or any EC-Council cert.

owner_sentence: (who owns the machines I will touch? I own ...)
authorized_assets: (localhost / VMs I created / $HOME/cyberlium-lab files)
forbidden_examples: (neighbor, school, employer without a signed contract, random IPs)
permission_rule: no packets at a target until writing names the owner
intent_rule: find weaknesses to document and fix — not steal, not deface, not trophy data
cia_link: I am stress-testing confidentiality, integrity, availability with the owner's knowledge
not_a_hat_license: white/black/grey labels are gossip; authorization is evidence
lab_folder: $HOME/cyberlium-lab
ethics: authorized lab only; chmod 600; I will not attack others
EOF

ls -l "$NOTES"

You now have a working definition you can defend in a job interview without pretending you bought a vendor course: ethical hacking in Cyberlium is authorized testing with defender intent, original teaching mapped to a public professional domain, never a substitute for EC-Council enrollment, never a dump, never a license to touch strangers. Your notes file is the artifact. Next — Five Phases as a Defender Map — you will name recon, scan, gain access, maintain, and cover tracks as a shared map that SOC analysts and authorized testers both use, still inside the permission switch you just wrote, still not a walkthrough for someone else’s network.