Proxies You Own vs Stranger Paths
curl -x is consent on YOUR process — then refuse LAN impersonation; dests /:8794.
Visual · own_proxy_vs_stranger
A proxy you set is not a LAN MITM. Later: curl -x Original Cyberlium.
If you typed -x, you invited the middle. If you poisoned ARP, you crashed a wedding you were not in.
Corporate TLS inspection, local debug proxies, and curl -x share a property: the client is configured to use that hop. ARP spoofing, rogue DHCP, and “transparent” café intercept share the opposite: the client did not opt in. Cyberlium only labors the first family, on loopback, against YOUR toy. That distinction is the whole ethics module. .
1. Consent is a client setting, not a vibe
Environment variables https_proxy, curl -x, browser proxy UI, PAC files: the process asked for a middle. Malware that sets those without telling you is a different crime on YOUR machine — still not a reason to practice on a café. Write: Cyberlium lab = you set -x toward
. Do not set the home router as a “forced proxy” for other DHCP clients.
2. Dry-run the invited hop without poisoning anyone
curl -x http:/// is the sentence you will run in the lab. If 8784 is down, curl fails — that is honest. Do not fall back to a LAN proxy you found with nmap. Do not use -x toward 192.168.0.1.
A debug proxy on loopback logging YOUR requests is how developers already work. A transparent middle on Wi-Fi is how incidents start.
Command guide
Dry-run the invited hop without poisoning anyone
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install nmap sudo apt install python3 sudo apt install dnsutils
macOS:
Command — copy this
brew install nmap brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Download https://python.org/downloads/ Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 2 -x "http://127.0.0.1:8784" "http://127.0.0.1:8794/" -o "$HOME/cyberlium-lab/t11-m05-via-proxy.body"
curl -sS -m 2 "http://127.0.0.1:8794/" -o "$HOME/cyberlium-lab/t11-m05-direct.body"
python3 - << 'PY'
import socket
for port in (8784, 8794):
s = socket.socket(); s.settimeout(0.4)
print("127.0.0.1:%s" % port, s.connect_ex(("127.0.0.1", port)))
s.close()
print("dry-run used -x 127.0.0.1:8784 only")
PY3. Refuse the impersonation toolkit by name
ettercap, arpspoof, bettercap against a LAN are not “the same as curl -x.” One is your process. The other is everyone else’s routing table. Write the refuse line in the same folder as the lab scripts so it sits next to muscle memory.
Also refuse 0.0.0.0 on the proxy: a logger that listens on every NIC is how YOUR lab becomes a stranger path for a phone that auto-proxied. Loopback only.
Command guide
Refuse the impersonation toolkit by name
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ COMMANDS ═══
Command — copy this
grep "impersonation" "$HOME/cyberlium-lab/t11-m05-consent.txt"
4. What you ship: consent language and a dry-run -x, not a spoofed gateway
Consent vs impersonation written. curl -x attempted toward 8794. DEMO GATE. Proxy bind will be loopback. ettercap/arpspoof refused by name.
5. What you record before the next lesson
Date. Invited hop vs LAN impersonation. Dry-run -x. /:8794. DEMO identified/STOP. NEVER ettercap/arpspoof/0.0.0.0. File t11-m05-l03-own-proxy.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
- Wrong: arpspoof so the room uses you. Set DHCP proxy on a hotel AP. nmap for open 8080 proxies to hijack.
- Right: Write consent. Dry-run curl -x on loopback. Next: Lab — Loopback Proxy on YOUR Traffic.
Mission: invite a middle on YOUR curl only
1) / STOP if router. 2) Write consent vs impersonation. 3) Attempt curl -x http:/// (failure is ok if down). Never spoof ARP. Never 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why -x is not ettercap — not how to become the default gateway for a guest SSID.
APPLY: Which command matches Cyberlium consent?
APPLY: True or False: A transparent café intercept is “the same” as curl -x because both are proxies.
APPLY: curl http://192.168.0.1/ is Router Admin. You wanted a “forced proxy lab.” You: