Lab — Capture Localhost HTTP You Started

HOST must be the characters 127.0.0.1 inside the file and in the --bind argument — not 0.0.0.0, not a café gateway, not argv, not “I’ll add a SAFETY flag later.” Binding loopback keeps the café from accidentally fetching your teaching server. Serve a directory you created for this lab, not your whole home directory. A single hello.txt you authored is enough. curl (or the Python client in the block, or Invoke-WebRequest) retrieves YOUR page so the server logs YOUR GET. You are proving that cleartext HTTP volunteers a request line on a path you caused. You are not load-testing. You are not adding query-string brute lists. You are not capturing the Wi-Fi adapter “for extra packets.”

Why not Wireshark for this lab? You may use a capture GUI later on loopback of a machine you own if you already know how — this assignment does not require it and does not ask you to install it on a café laptop. The server log is the authorized microscope: it prints the request you sent. That is enough to feel Lesson 1’s scare without touching anyone else’s frames. If you already opened Wireshark, select only the loopback adapter and only while you curl 127.0.0.1, then stop. Never the café SSID. Never promiscuous mode on a shared network. Never “the roommate said it was fine” as a substitute for this loopback lab.

Python’s http.server prints a log line similar to 127.0.0.1 - - [date] "GET / HTTP/1.1" 200 -. Copy that request line honestly into ceh-sniff-lab.txt. If you curled /hello.txt, the path will match. Required rows: legal line (original Cyberlium, not official CEH, not a cert, not dumps); HOST = 127.0.0.1; bind command; curl command; pasted request line; one sentence that this is cleartext you caused and TLS would have hidden the payload; lockdown (Ctrl+C, do not leave 0.0.0.0); ethics (no café Wireshark, no roommate tcpdump, no ettercap). chmod 600 on the notes, the helper, and hello.txt.

Failure modes that still pass if you tell the truth: forgot to start the server, curl fails, you start it and retry on loopback. Port 8000 in use by something else you own — identify YOUR process or choose 8001 and document it. Failure modes that fail the course: Wireshark on café Wi-Fi, tcpdump of a roommate, HOST rewritten to the LAN, notes chmod 644 on a shared PC, a pcap of the dorm switch pasted as “the request line.”

Windows PowerShell: py -m http.server 8000 --bind 127.0.0.1 in a throwaway folder, then curl.exe http://127.0.0.1:8000/ or Invoke-WebRequest http://127.0.0.1:8000 . Copy the request line from the server window. WSL and Git Bash can use the bash block as written. Record which OS and which client you used so the notes are reproducible on YOUR box. After the paste, Ctrl+C the server. Do not leave it bound to 0.0.0.0 overnight. Do not point http.server at someone else’s files.

sudo apt install curl

curl -sS -m 2 -v "http://127.0.0.1:8000/" 2>&1 | grep -E "GET |Host:" | head

ss -ltn | grep 8000

Follow the block. Do not merge “start server” and “curl” in a way that leaves the server running unattended on shared Wi-Fi. When notes are filled, Ctrl+C the server. Windows notes sit at the bottom of the script comments.

cat > "$NOTES" << 'EOF'
HOST: 127.0.0.1
REQUEST_LINE: (paste GET / HTTP/1.1)
BIND: 127.0.0.1:8000
STOPPED: (Y after Ctrl+C)
ETHICS: no cafe capture
EOF

You caused both ends of a cleartext HTTP conversation on loopback, copied YOUR request line, locked the file, and closed the door. That is authorized sniffing literacy as Cyberlium teaches it — original, not an exam dump, not EC-Council lab text, not a cert. Next — Quiz — Sniffing — ten APPLY items on scope, ARP as a table not a weapon, TLS versus metadata, and why café and roommate captures stay out. Then Module 9: humans as the channel.