Aux Ethics
Written scope, no brute force on real services, no scan-as-a-service for friends.
Visual · msf_aux_ethics
Aux ethics = RoE + refusal list. Original Cyberlium.
“It's just a scanner” is how careers end.
Aux modules can brute credentials and enumerate users — that is still unauthorized on systems you do not own. Refuse: café scans, school networks, “scan my ex's site,” ransomware prep. Teach defender view: lockout policies, IDS alerts, legal exposure.
1. Refusal list
No aux against stranger IPs, production SaaS, or classmate personal devices.
No offering “MSF scans” as a favor on unknown networks.
Command guide
Try these commands — Refusal list
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Aux ethics — https://nmap.org/book/legal-issues.html Auxiliary scans — https://docs.rapid7.com/metasploit/running-module-auxiliary-scans/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
Command — copy this
sudo apt install nmap
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Command — copy this
brew install nmap
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
nmap -sn "${LAB_HOST:-127.0.0.1}/32" 2>/dev/null || echo 'REFUSE: café /24 scans'
msfconsole -q -x 'use auxiliary/scanner/discovery/udp_sweep; show options; exit' 2>/dev/null || echo 'Review options — set RHOSTS to single LAB IP'Primary tools to practice this lesson: msfconsole, nmap. Reference sites: Aux ethics (https://nmap.org/book/legal-issues.html); Auxiliary scans (https://docs.rapid7.com/metasploit/running-module-auxiliary-scans/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Brute and fuzz caution
Login aux modules can lock accounts — only on disposable $LAB creds.
Document thread counts low on lab to practice restraint.
3. Legal literacy
Computer misuse laws do not care that the module is auxiliary.
Written lab RoE is your authorization anchor.
4. What you ship: aux ethics refusal list
NEVER list for aux + lockout awareness on $LAB only.
5. What you record before the next lesson
Refusal list in notes.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: HTTP aux brute against a live shop login.
- Right: Ethics list written. Next: aux lab.
Mission: aux ethics sheet
1) Write five NEVER aux targets. 2) Write lockout risk sentence. 3) Cite RoE file path.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Is aux brute ‘lighter’ legally?”
APPLY: Aux against stranger SaaS:
APPLY: True or False: Scanner label makes unauthorized access OK.
APPLY: Brute aux on lab should use: