Network › Module 5 › Lesson 4
Lab — Loopback Proxy on YOUR Traffic
HTTP logger on forwarding to YOUR — curl -x only; never ettercap/arpspoof.
Visual · loopback_proxy_lab
Lab: YOUR proxy, YOUR toy, YOUR curl -x. Bind 127.0.0.1 never 0.0.0.0.
Opening
The only middle in this lab is a process you started, fed by a flag you typed.
Start a tiny HTTP toy on Start a tiny logger-proxy on that forwards to that toy and appends request lines to a file. curl -x http:///. Read the log. That is path-integrity literacy with consent. It is not MITM of a LAN. Original Cyberlium.
1. Start YOUR toy, then YOUR proxy — both loopback
Two processes, two ports, HOST = 127.0.0.1. The toy is boring HTTP. The proxy accepts curl’s absolute-form GET and fetches , logging the path. ; do not point -x at the router.
If a snippet binds the proxy to 0.0.0.0, refuse. Phones must not wander into YOUR logger.
Command guide
Start YOUR toy, then YOUR proxy — both loopback
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t11-m05-toy.py" << 'PY'
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
HOST, PORT = "127.0.0.1", 8794
class H(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200); self.end_headers()
self.wfile.write(b"toy ok bind=127.0.0.1:8794
")
def log_message(self, fmt, *args):
pass
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")
ThreadingHTTPServer((HOST, PORT), H).serve_forever()
PYCommand — copy this
cat > "$HOME/cyberlium-lab/t11-m05-proxy.py" << 'PY'
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from urllib.request import urlopen, Request
import os, datetime
HOST, PORT, UP = "127.0.0.1", 8784, "http://127.0.0.1:8794"
LOG = os.path.expanduser("~/cyberlium-lab/t11-m05-proxy.log")
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")
class H(BaseHTTPRequestHandler):
def do_GET(self):
target = self.path if self.path.startswith("http://") else (UP + self.path)
if not target.startswith("http://127.0.0.1:8794"):
self.send_response(403); self.end_headers(); self.wfile.write(b"refusing non-toy dest
"); return
with open(LOG, "a", encoding="utf-8") as f:
f.write("%s %s
" % (datetime.datetime.utcnow().isoformat() + "Z", target))
try:
with urlopen(Request(target), timeout=3) as r:
body = r.read(); code = r.status
except Exception as e:
self.send_response(502); self.end_headers(); self.wfile.write(str(e).encode()); return
self.send_response(code); self.end_headers(); self.wfile.write(body)
def log_message(self, fmt, *args):
pass
ThreadingHTTPServer((HOST, PORT), H).serve_forever()
PYCommand — copy this
if [ -f "$HOME/cyberlium-lab/t11-m05-toy.pid" ]; then kill "$(cat "$HOME/cyberlium-lab/t11-m05-toy.pid")" || true; fi if [ -f "$HOME/cyberlium-lab/t11-m05-proxy.pid" ]; then kill "$(cat "$HOME/cyberlium-lab/t11-m05-proxy.pid")" || true; fi python3 "$HOME/cyberlium-lab/t11-m05-toy.py" & sleep 1 python3 "$HOME/cyberlium-lab/t11-m05-proxy.py" & sleep 1
2. curl -x the invited hop; read YOUR log
curl -x http:/// should print toy ok and grow t11-m05-proxy.log. Direct curl to 8794 should not need the proxy and may not log. That contrast is the point.
Do not add -x 192.168.0.1. Do not ettercap to “compare.” If curl hangs, check YOUR pids on loopback.
Command guide
curl -x the invited hop; read YOUR log
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 3 -x "http://127.0.0.1:8784" "http://127.0.0.1:8794/" | tee "$HOME/cyberlium-lab/t11-m05-lab-via.body" curl -sS -m 2 "http://127.0.0.1:8794/" | tee "$HOME/cyberlium-lab/t11-m05-lab-direct.body" tail -n 5 "$HOME/cyberlium-lab/t11-m05-proxy.log"
3. Bind audit, dest refuse, stop YOUR pids
grep both scripts for 127.0.0.1. Confirm the proxy refuses dests that are not — that is how you avoid turning a homework logger into an open relay. Kill both pids you started.
Write NEVER ettercap/arpspoof one last time. Notes chmod 600. Quiz is next.
Command guide
Bind audit, dest refuse, stop YOUR pids
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
grep -n "127.0.0.1" "$HOME/cyberlium-lab/t11-m05-toy.py" "$HOME/cyberlium-lab/t11-m05-proxy.py"
grep -n "0.0.0.0" "$HOME/cyberlium-lab/t11-m05-toy.py" "$HOME/cyberlium-lab/t11-m05-proxy.py" && echo "FAIL"
python3 - << 'PY'
import socket
for port in (8784, 8794):
s = socket.socket(); s.settimeout(0.4)
print("127.0.0.1:%s" % port, s.connect_ex(("127.0.0.1", port)))
s.close()
PYCommand — copy this
kill "$(cat "$HOME/cyberlium-lab/t11-m05-proxy.pid")" kill "$(cat "$HOME/cyberlium-lab/t11-m05-toy.pid")"
4. What you ship: a consented log line from curl -x, two loopback binds, a dest guard
Toy 8794 and proxy 8784 on 127.0.0.1. curl -x succeeded. proxy.log grew. Dest guard refuses non-toy URLs. DEMO GATE. Pids stopped. No ettercap. No 0.0.0.0.
5. What you record before the next lesson
Date. curl -x → wc -l proxy.log. Bind audit. DEMO identified/STOP. NEVER ettercap/arpspoof/nmap/0.0.0.0. File t11-m05-l04-proxy-lab.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
ettercap the café to compare logs. arpspoof a roommate into YOUR proxy. Bind 8784 to 0.0.0.0. curl -x the home router.
Right
Two loopback processes, curl -x, read YOUR log, stop pids. Next: Quiz — Path Integrity.
Mission: log YOUR HTTP because you typed -x
1) / STOP if router. 2) Start toy and proxy. 3) curl -x http:/// 4) wc -l the proxy log, bind audit, stop YOUR pids. Never ettercap/arpspoof. Never 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
If curl -x fails, ask Mentor whether YOUR proxy pid is on — not how to ARP-spoof a gateway.
Knowledge Check
APPLY: The lab proxy snippet binds ("0.0.0.0", 8784). You:
Multiple choice
Knowledge Check
APPLY: True or False: curl -x http:/// is the in-scope path-integrity lab.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is Router Admin during the proxy lab. You:
Multiple choice