Network › Module 7 › Lesson 2
Spoofing as an Idea on YOUR Hosts File
Practice file first: $HOME/cyberlium-lab/hosts-practice — never “overwrite Windows hosts” as the only path.
Visual · hosts_file_idea
Hosts-file spoofing is an idea you practice in a FILE YOU OWN. Never spoof someone else's DNS.
Opening
The oldest “wrong answer on purpose” is a hosts file. Practice in cyberlium-lab, not by trampling the OS file as the only trick.
A hosts file is a local override: this name shall mean that IP, before (or instead of) asking the network. Attack stories love the system file because it is privileged. Cyberlium loves a practice file because you can learn the idea without turning THIS PC's real name resolution into a foot-gun, and without touching anyone else's resolver. Original Cyberlium.
1. The idea: a name can be pinned to an IP you chose
If a lookup path consults a hosts-style table first, the app may never ask a public resolver. That can be a feature (pin a lab name to loopback) or an incident (malware pins a bank name to a liar). Same mechanism, opposite intent.
We demonstrate the feature with a file you own: t11.cyberlium.lab → 127.0.0.1. We do not demonstrate pinning real banks. We do not push fake records onto a LAN.
Command guide
The idea: a name can be pinned to an IP you chose
═══ COMMANDS ═══
Command — copy this
printf '%s ' '127.0.0.1 t11.cyberlium.lab' '# practice only — not the OS hosts file' > "$HOME/cyberlium-lab/hosts-practice"
2. Practice file first; OS hosts is a privileged exception
Windows system hosts and Unix /etc/hosts affect the whole machine and usually need elevation. Students who only ever learn “edit system hosts” break their own PCs and skip the safer model. Cyberlium's required path is the practice file. If you later choose to edit the real hosts file on a machine you own, that is a separate, careful, reversible decision — not this lesson's default.
Do not tell a classmate to overwrite their system hosts “so the lab grades.” Do not remotely change anyone else's hosts. That is someone else's DNS trust, which this course refuses.
Command guide
Practice file first; OS hosts is a privileged exception
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
from pathlib import Path
p = Path.home() / "cyberlium-lab" / "hosts-practice"
print("practice_file", p)
for line in p.read_text(encoding="utf-8", errors="replace").splitlines():
s = line.split("#", 1)[0].strip()
if s:
print("row:", s)
print("do not overwrite Windows system hosts as the only path")
print("never spoof someone else's DNS")
PY3. curl --resolve is another local pin, still on loopback
If you want a browser-class client to use t11.cyberlium.lab without touching system hosts, curl --resolve can pin that name to 127.0.0.1 for one command. That is still YOUR process, YOUR loopback, YOUR teaching port 8786.
It is not a DNS spoof against a neighbor. It is not BIND on 0.0.0.0 answering the building.
4. What you ship: hosts-practice with t11.cyberlium.lab → 127.0.0.1
Create $HOME/cyberlium-lab/hosts-practice. Do not treat OS hosts overwrite as the only method. Do not spoof anyone else's DNS. / STOP if router. Teaching port 8786 on loopback only.
5. What you record before the next lesson
hosts-practice mapping. Ethics: practice file first. DEMO identified/STOP. SAFE File t11-m07-l02-hosts-idea.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Overwrite C:\Windows\System32\drivers\etc\hosts as the only lab. Push fake A records to a LAN. Change a roommate's DNS servers “as a prank.”
Right
Write hosts-practice. Pin t11.cyberlium.lab to 127.0.0.1. Leave system hosts and other people alone. Next: DoH and Resolver Hygiene.
Mission: pin a PRACTICE name to loopback
1) / STOP if router. 2) Write $HOME/cyberlium-lab/hosts-practice mapping t11.cyberlium.lab to 127.0.0.1. 3) Note that OS hosts overwrite is not the only path. Never spoof someone else's DNS.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how curl --resolve pins a name for one process — not how to poison the office resolver.
Knowledge Check
APPLY: The required Cyberlium mapping for this lesson is:
Multiple choice
Knowledge Check
APPLY: True or False: You may spoof a neighbor's DNS if the SSID is your home network and they did not opt out.
True or False
Knowledge Check
APPLY: Malware pins bank.example to a liar via hosts. Same mechanism as the lab?
Multiple choice