Lab — Inventory Gadgets You Own

Pick objects whose admin you already use: the router you pay for, the camera you installed, the plug in YOUR outlet, the printer on YOUR desk, the doorbell on YOUR frame, the Pi on YOUR shelf. Look at the object. Open the vendor app or the LAN page you already open as owner. You are copying status, not discovering a network you do not administer. Do not run a ping sweep “to be thorough.” Do not import a default-password list to test rows. Do not walk a dorm hallway with a discovery app. A throwaway folder under $HOME/cyberlium-lab holds the table — not a pcap, not a hydra session, not screenshots of a stranger’s lens. If a roommate’s gadget sits on a SSID you share, it is still not yours unless they stand there and ask you to help; this lab does not require their row. Leave it off the list.

Windows, macOS, and phone are fine as the chair you sit in while you type. The inventory is about gadgets, not about scanning the PC. Record which OS you typed on so the notes are reproducible. If you administer a tiny lab VLAN at home, those gadgets count. If you only have a locked-down work laptop and no home router access, write none owned for IoT plus the ethics block — do not “use the office cameras” and do not scan the building BMS. Work MDM that already shows YOUR enrolled phone to YOU is not an IoT row unless it is actually a gadget you are inventorying; do not dump a corporate device list into this file.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat > "$NOTES" << 'EOF'
=== IOT INVENTORY LAB (Cyberlium M18 L04) ===
TYPE DEFAULT_CHANGED GUEST_NET
(camera/plug/none owned — fill)
ETHICS: eyes+Settings, not nmap /24, not hydra
EOF

Required keys the checker will look for: DISCLAIMER, ETHICS, NEVER, and either NONE_OWNED or at least DEVICE_1 with DEFAULT_CHANGED and GUEST_NET filled as yes, no, or n/a — not leftover parentheticals. Type is a noun you chose (camera, router, plug, printer, doorbell, hub, DVR, Pi). Vendor is a brand you can see on the plastic or in the app. DEFAULT_CHANGED is whether the factory pair is gone. GUEST_NET is whether it sits on the guest/IoT island from Lesson 3 (or n/a if the box is the router itself, or no if it is still on main). Optional but useful: firmware checked, WAN/remote-admin off, action. Timestamp UTC. chmod 600 on the notes and the helper. Do not store the new password in this file. Do not store a neighbor’s serial.

Failure modes that still pass if you tell the truth: guest toggle missing — write GUEST_NET no and ACTION move-to-guest-or-compensating-control; firmware unknown — write unknown and isolate-or-replace if the vendor is gone; you have not changed a default yet — write no and change it on YOUR device the same sitting if you can, then yes. Failure modes that fail the course: success against a hallway camera, a plant HMI, a hospital pump, a Shodan hit, a dorm /24 sweep, notes chmod 644 on a shared PC with foreign IPs, a default-password dump pasted as “research.”

grep -E "TYPE|DEFAULT_CHANGED|GUEST_NET|ETHICS" "$NOTES"

Cyberlium would rather an honest empty closet than a stolen row. Write NONE_OWNED: none owned. Write why (renter with ISP modem you cannot admin, laptop-only, no cameras). Still write DISCLAIMER, still write ETHICS, still write NEVER, still chmod 600. Do not pad the table with a café thermostat, a neighbor doorbell, or a stock photo of a factory. Do not scan a /24 “so I have rows.” The quiz will treat none owned as valid when the ethics block is present. The confirmation checkbox is you asserting you used your eyes on YOUR space, including the eyes that saw nothing IoT-shaped.

If you later buy a camera, you may add a row. You may not add a row for a device you saw on a public map. You may not add a PLC. Completing “none owned” does not mean you owe the course a shopping trip. It means you refused to invent scope.

mkdir -p creates cyberlium-lab. The here-document writes iot-inventory-lab.txt with placeholders. You replace placeholders in an editor. Python reads UTF-8 text, checks required keys, accepts none owned, fails leftover parentheticals unless none owned is set, fails bait phrases (Shodan search, plant scan, hospital, neighbor camera as a target, hydra, /24 sweep), prints PASS or FAIL. chmod 600 restricts the file to you on Unix-like systems. Windows: WSL or Git Bash for chmod, or tighten NTFS permissions on your user profile. There is no nmap. There is no masscan. There is no Shodan API. There is no default-password loop. If you added those, you left the lab.

Rerun the checker after you edit. A PASS that still lists 10.20.30.4 as “factory HMI” is an ethics fail you catch with your eyes. The confirmation checkbox is you asserting you used your eyes. Do not gist the file. Sibling notes (iot-default-creds, ot-ics, iot-isolation) stay; they are not substitutes for this filename. Empty any line that still contains someone else’s serial if you pasted it by mistake.

Follow the block on a computer you own. Fill blanks from objects you touched, not from a blog. When the notes are filled, run the checker, chmod 600. Optional: change a remaining default and move a camera to guest the same sitting so the ticks match the room.

A mode-600 file with honest rows or an honest none owned line is the whole lab. Ctrl+C nothing: you started no server. Do not leave a scanner running “in case I missed a plug.” Do not add a second sitting that Shodans webcams because two rows felt small. Re-run the checker after edits. World-writable 777 fails. You now have the household artifact Lessons 1–3 were aiming at: defaults, isolation, and a refuse list that names plants and hospitals out loud. This is original Cyberlium teaching mapped to the CEH v13 IoT and OT hacking domain — not official EC-Council training, not a cert, not exam dumps. Next — Quiz — IoT and OT — ten APPLY items on stickers and guest nets, then Module 19 opens Shared Responsibility in One Page for cloud accounts YOU own.