Ethical › Module 11 › Lesson 4
Lab — Inspect Cookie Flags on a Site You Own
DevTools on YOUR app or a local page you wrote — not intercepting others.
Visual · cookie_flags_lab_localhost
HOST hardcoded 127.0.0.1. Tiny page YOU wrote sets Set-Cookie with flags you document — or DevTools on an app YOU own. ceh-cookie-flags.txt chmod 600. Never café intercept. Never others’ cookies.
Opening
You mint the cookie. You read the flags. You lock the notes. That is the whole session lab — not a café tap and not someone else’s jar.
Lessons 1–3 defined the token, named leak paths without a PoC, and wrote Secure, HttpOnly, SameSite, short TTL, and revoke. This lab is the hands: a tiny HTTP listener bound to 127.0.0.1 that returns HTML YOU wrote plus Set-Cookie lines YOU chose, or DevTools on an application YOU own (your staging app, your Pages project, your local Flutter/web build). You will copy the Set-Cookie flags — not a stranger’s session value — into $HOME/cyberlium-lab/ceh-cookie-flags.txt and chmod 600. You are the server author. The header is evidence of flags you control. You do not need a café. You do not need a classmate login. You do not need Wireshark. You will not intercept café users. You will not steal others’ cookies. You will not XSS a live site. You will not replay a token into a victim origin. You will not bind 0.0.0.0 so the floor can hit your teaching server. If 8766 is busy, pick another high port on loopback and write that port in the notes. Empty notes fail. Notes that contain other people’s Cookie values or a shared-SSID pcap fail ethics even if Python ran. This is original Cyberlium teaching mapped to the CEH v13 session-hijacking domain — not official EC-Council training, not a cert, not exam dumps. Next is Quiz — Session Hijacking, then Module 12: firewalls as policy, not magic — still no bypass cookbook.
1. Lab surface: HOST frozen, YOUR HTML, flags you set — or YOUR app’s DevTools
HOST must be the characters 127.0.0.1 inside the file and in the bind address — not 0.0.0.0, not a café gateway, not argv, not “I’ll add a SAFETY flag later.” Binding loopback keeps the café from accidentally fetching your teaching page. Serve HTML you authored for this lab, not a copy of a bank login. The handler sends at least two Set-Cookie headers you can name: one with HttpOnly and SameSite=Lax and Max-Age, one that also includes Secure so you can document the attribute even if a browser refuses to persist Secure cookies on http://. curl -sI (or Invoke-WebRequest) is enough to read the flags. Optional: open http://127.0.0.1:8766/ in a browser YOU control and use DevTools Network → the document request → Response Headers, or Application → Cookies columns (HttpOnly, Secure, SameSite). You are proving you can see flags on a cookie you minted. You are not dumping document.cookie into chat. You are not capturing the Wi-Fi adapter “for extra cookies.”
Alternative path if you already ship an app: skip the toy listener and open DevTools on a host you own (localhost of YOUR app, or YOUR staging hostname). Document the Set-Cookie flags YOUR stack actually sends for a throwaway account you created. Do not use a production customer session. Do not screenshot a coworker’s browser. Do not “also check” a school portal. Ownership is the control. If you do not own a deployed app, the loopback page is the whole lab — that is enough. Why not Wireshark? This assignment does not require it. The response header is the authorized microscope. If you already opened a capture GUI, select only loopback on a machine you own while you curl 127.0.0.1, then stop. Never the café SSID. Never promiscuous mode on a shared network.
2. What to copy: flag columns, bind proof, lockdown, ethics — not a stolen sid
Required rows in ceh-cookie-flags.txt: legal line (original Cyberlium, not official CEH, not a cert, not dumps); HOST = 127.0.0.1 or “DevTools on an app I own: <hostname I control>”; paste of YOUR Set-Cookie lines (you may redact the value to demo or leave a throwaway lab value — never a real production sid); a table in words: Secure present/absent, HttpOnly present/absent, SameSite value, Max-Age; one sentence that HttpOnly means script should not read that cookie and Secure means HTTPS-only attach; lockdown (Ctrl+C the listener if you started one; do not leave 0.0.0.0); ethics (no café intercept, no others’ cookies, no live XSS). chmod 600 on the notes, the helper, and the HTML.
Failure modes that still pass if you tell the truth: forgot to start the server, curl fails, you start it and retry on loopback. Browser did not store the Secure cookie on http:// — write that honestly; curl still showed the attribute. Port 8766 in use by something else you own — choose 8767 and document it. Failure modes that fail the course: Wireshark on café Wi-Fi, copying a classmate Cookie header, HOST rewritten to the LAN, XSS against a live shop “to confirm HttpOnly,” notes chmod 644 on a shared PC, a pcap of the dorm switch pasted as “the flags.”
3. Windows and bash: same HOST lock, then stop the listener
Windows PowerShell: py cookie_flags_lab_server.py in one window, then curl.exe -sI http://127.0.0.1:8766/ or Invoke-WebRequest -Method Head http://127.0.0.1:8766/ and inspect Headers["Set-Cookie"]. Optional: Start-Process http://127.0.0.1:8766/ and use Edge/Chrome DevTools on that tab only. WSL and Git Bash can use the bash block as written. Record which OS and which inspector you used (curl vs DevTools vs both). After the paste, Ctrl+C the server. Do not leave it bound to 0.0.0.0 overnight. Do not point the handler at someone else’s files. Do not add a JavaScript snippet that posts cookies to a webhook — that is a stealer, even on localhost, and it trains the wrong muscle.
4. Wrong vs right: café intercept / stolen jars vs YOUR Set-Cookie on loopback
Worked failure — same “I want to see cookie flags,” opposite jar. Right never needs a second person’s login when loopback will send YOUR Set-Cookie.
Wrong
Wireshark on café / hotel / campus Wi-Fi. Copy a classmate or bank session cookie. XSS a live site to read document.cookie. Bind 0.0.0.0. Replay a stolen sid. Skip chmod. Call the lab incomplete without a stranger’s inbox. This course is not official CEH training and does not grade that hunt.
Right
python cookie_flags_lab_server.py with HOST hardcoded 127.0.0.1 (or DevTools on an app YOU own). curl -sI / inspect Set-Cookie. Fill ceh-cookie-flags.txt, chmod 600 under $HOME/cyberlium-lab. Stop the server. Next: Quiz — Session Hijacking.
5. Hands-on: bind loopback, inspect YOUR flags, chmod 600, stop
Follow the block. Do not merge “start server” and “browse” in a way that leaves the server running unattended on shared Wi-Fi. When notes are filled, Ctrl+C the server. Windows notes sit at the bottom of the script comments. The Python refuses to run if HOST is not 127.0.0.1.
Command guide
Copy flag columns — WHAT/WHY (not a stolen sid)
═══ COMMANDS ═══
Command — copy this
cat > "$NOTES" << 'EOF' HOST: 127.0.0.1 SECURE: (Y/N) HTTPONLY: (Y/N) SAMESITE: (Lax/Strict/None/absent) SID_VALUE: (do not paste a real foreign session) ETHICS: MY flags only EOF
Mission: ceh-cookie-flags.txt — YOUR Set-Cookie flags, chmod 600
1) Start cookie_flags_lab_server.py with HOST hardcoded 127.0.0.1, or open DevTools on an app YOU own. Inspect Set-Cookie (curl -sI or Network/Application panels). 2) Document YOUR flags (Secure, HttpOnly, SameSite, Max-Age) in $HOME/cyberlium-lab/ceh-cookie-flags.txt. chmod 600. Stop the listener if you started one. 3) Ethics: never intercept café users, never steal others’ cookies, never live XSS, never replay tokens. Original Cyberlium teaching, not official CEH, not a cert.
Stuck? Ask Cyberlium AI Mentor
If “the lab is incomplete without Wireshark on café Wi-Fi or a stolen bank cookie” still feels true, ask for a hint — not a steal recipe. Try: "Hint only: why HOST must stay hardcoded 127.0.0.1, why curl -sI of MY Set-Cookie (or DevTools on an app I own) is the whole cookie lab, why notes need chmod 600, and why café intercept / others’ cookies fail ethics?" You still fill ceh-cookie-flags.txt. No 0.0.0.0. No XSS. No replay.
You caused a Set-Cookie on a host you own, read the flags, locked the file, and closed the door. That is authorized session-hygiene literacy as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text, not a cert. Next — Quiz — Session Hijacking — ten APPLY items on tokens, leak paths as concepts, flags, revoke, and why café intercepts and stolen cookies stay out. Then Module 12: Firewalls as Policy, Not Magic.
Knowledge Check
APPLY: curl -sI http://127.0.0.1:8766/ after a server YOU started shows Set-Cookie with HttpOnly and SameSite. What did the lab demonstrate, and what must you do next?
Multiple choice
Knowledge Check
APPLY: True or False: If loopback is boring, the ethical completion is intercepting café users and importing a classmate cookie because Module 11 is “session hijacking.”
True or False
Knowledge Check
APPLY: Which note file pairing matches this lab’s ethics and hygiene?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice