Lab — Scan 127.0.0.1 Only

HOST must be the characters 127.0.0.1 inside the file — not a variable you read from the command line, not a pasted LAN address, not “I’ll add a SAFETY flag later.” A flag you forget is how yesterday’s localhost tool becomes today’s café scan. Print HOST on the first output line so the artifact is self-explaining. PORTS stay [22, 80, 443, 8000]. Timeout 0.5 seconds is plenty on loopback. A hang means you dropped settimeout; fix the script. Do not run as root to “see more.” Connecting to high ports on loopback does not need uid 0.

Each port is one question you already practiced: connect_ex((127.0.0.1, port)). 0 means OPEN from here — a process on this OS accepted TCP. Nonzero means closed_or_filtered in the wait window. Port 22 is often closed unless you installed SSH on this box. 80 and 443 closed unless you run a local web server. 8000 closed until you start Python’s http.server — that is the intended optional OPEN. Closed-only on the first pass is a complete scan, not a broken lab.

sudo apt install nmap
sudo apt install python3

brew install nmap
brew install python3

choco install nmap  # or download https://nmap.org/download.html

nmap -sT 127.0.0.1 -p 22,80,443,8000,8080
nmap -sV 127.0.0.1 -p 1-1000

Python socket scanner (educational)

python3 -c "
import socket
for port in [22, 80, 443, 8000, 8080]:
    s = socket.socket()
    s.settimeout(0.5)
    r = s.connect_ex(('127.0.0.1', port))
    print(f'Port {port}: {"OPEN" if r == 0 else "CLOSED"}')
    s.close()
"

PowerShell

1..1024 | ForEach-Object { $p=$_; try { $c=New-Object Net.Sockets.TcpClient; $c.Connect('127.0.0.1',$p); Write-Host "Port $p OPEN"; $c.Close() } catch {} }

nmap -sT 127.0.0.1 -p 22,80,443,8000,8080

In a throwaway folder you created (not your whole home directory), Terminal A: python3 -m http.server 8000 --bind 127.0.0.1 (or python / py -m). Binding loopback keeps the café from accidentally becoming your student. Leave it running. Terminal B: run the scanner; confirm 8000 OPEN. Fill notes. Ctrl+C Terminal A. Scan again; 8000 should return closed_or_filtered. Timestamp both. If 8000 is busy, pick another high port you bind on loopback and write that port in the notes — still 127.0.0.1. If --bind is missing on ancient Python, keep the machine off untrusted networks and stop the server immediately after the scan.

Windows users: py -m http.server 8000 --bind 127.0.0.1 in PowerShell, then either the Python scanner or Test-NetConnection 127.0.0.1 -Port 8000. WSL and Git Bash can use the bash block as written. Record which OS and which client you used so the notes are reproducible on YOUR box. Do not point http.server at someone else’s files. Do not leave it on 0.0.0.0 overnight. Do not add directory brute lists or POST bodies. The lab is TCP connect inventory plus an optional door you started, not a web attack.

Required rows: legal line (original Cyberlium, not official CEH, not a cert, not dumps); HOST = 127.0.0.1; port list; timeout; each port’s state; optional server command; scan-while-running; scan-after-stop; ethics (no café, campus, neighbor, internet nmap); chmod reminder. Empty OPEN on pass one is allowed if you say so. Notes that list other people’s IPs fail ethics even if Python ran. World-writable 777 fails. If you already have Topic 7’s localhost-scan.txt, you may copy loopback rows in — still no LAN rows, still chmod 600 on ceh-scan.txt.

Failure modes that still pass if you tell the truth: forgot to start the server, 8000 closed, you start it and retry on loopback. Port 8000 in use by something else you own — identify YOUR process or choose 8001. Failure modes that fail the course: success against 10.x campus, nmap 192.168.1.0/24, HOST rewritten, notes chmod 644 on a shared PC, Metasploit because 8000 opened.

Follow the block. Do not merge “start server” and “scan” in a way that leaves the server running unattended on shared Wi-Fi. When notes are filled, Ctrl+C the server and rerun the closed check. Windows notes sit at the bottom of the script comments.

You ran a real connect scan without leaving loopback: hardcoded 127.0.0.1, four ports, timeout, optional local http.server, locked notes, server stopped. That is authorized scanning as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text, not a cert. Next — Quiz — Network Scanning — ten APPLY items on the HOST lock, connect versus stealth without an evasion cookbook, OPEN versus closed, and why café and campus scans stay out. Then Module 4: enumeration vs scanning, still on a listener you started.