Lab — Write Your Personal RoE

A personal RoE is shorter than a law-firm stack and stricter than a vibe. It must name you as tester, name you (or a legal entity you actually control) as owner, list in-scope assets in concrete language, list out-of-scope examples so you cannot later claim confusion, list allowed activities for Cyberlium (notes, local files, VMs you create, loopback), list banned activities (anything against systems you do not own or lack writing for), set a stop rule, and set data handling: this folder, mode 600, no public gists, no live passwords from real accounts.

Concrete in-scope language looks like: 127.0.0.1; VMs I created whose disks live on this computer; Docker compose apps I started on localhost ports I chose; files I authored under $HOME/cyberlium-lab. Concrete out-of-scope language looks like: roommate devices; campus or employer networks; cloud accounts I do not own; public companies; bug-bounty targets I have not separately enrolled in under their policy (and this course does not require that); any IP I cannot justify as mine in one sentence. If a later lesson offers example.com as a public-read (certificate, DNS), that is a documented exception for browser-equivalent reads — not a license to exploit example.com.

The file is for you to reread when a future module is exciting. Excitement is when people “just nmap the dorm.” The RoE is the dull page that says no. If you live with others, say so in the out-of-scope list. If you use a cloud VM, it is in scope only if the account is yours and the instance is yours — not a trial you found, not a classmate’s box. Write dates: this RoE is for Cyberlium Topic 9 labs starting today. You can amend it; you cannot silently expand it to the internet.

for method in GET POST PUT DELETE OPTIONS; do
  curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
done

curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <TEST_TOKEN>" \
  -d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || cat

curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"

The lab script writes a template, then a Python checker looks for heading keys. You must replace parentheticals. Required keys: DISCLAIMER, TESTER, OWNER, IN_SCOPE, OUT_OF_SCOPE, ALLOWED, BANNED, STOP_RULE, DATA_HANDLING, ETHICS. The checker also fails if IN_SCOPE is still a placeholder, if OUT_OF_SCOPE is empty, or if the file contains bait phrases that mean you tried to authorize the planet (for example leaving TODO_SCAN_THE_INTERNET in place). It does not try to be a lawyer. It tries to stop a blank file from counting as a lab.

DISCLAIMER must include the Cyberlium legal sentence in spirit: original curriculum, mapped to a CEH v13 domain, not official EC-Council training, not a CEH exam dump, completing it does not grant CEH. Copying that idea in your own words is required because Module 1 keeps lying to people who skip it. TESTER and OWNER should usually both be you for this lab. If OWNER is “my employer” and IN_SCOPE is production, you failed the course ethics even if the checker’s string match passes — the checker cannot see employment law. You can. Do not gaslight it.

ALLOWED should mention notes, chmod 600, local/lab-only work, and describing the five-phase map. BANNED should mention attacking others, unauthorized scanning, exploiting strangers, wiping others’ logs, storing dumped personal data, and claiming this file is official CEH courseware. STOP_RULE can be ordinary: if I am unsure whether a target is mine, I stop. DATA_HANDLING: path $HOME/cyberlium-lab/ceh-roe.txt, mode 600, no gist. ETHICS: authorized lab only.

for method in GET POST PUT DELETE OPTIONS; do
  curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
done

curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <TEST_TOKEN>" \
  -d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || cat

curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"

mkdir -p creates the lab directory. The here-document writes ceh-roe.txt. Python reads the file as UTF-8 text, checks for keys, prints PASS or FAIL with missing keys. chmod 600 restricts the file to you on Unix-like systems. On Windows, use WSL or Git Bash for chmod, or tighten NTFS permissions on your user profile. There is no nmap, no curl to a third party, no socket connect in the checker. If you added those, you left the lab.

Rerun the checker after you edit. A PASS that still lists a neighbor in IN_SCOPE is an ethics fail you must catch with your eyes. The confirmation checkbox is you asserting you used your eyes. Do not check it because Python printed a banner. Do not email the file to a stranger to “grade.” Do not put real SSO passwords in it. A toy lab password you made for a VM is already generous; prefer not even that — name the VM instead.

for method in GET POST PUT DELETE OPTIONS; do
  curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
done

curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <TEST_TOKEN>" \
  -d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || cat

curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"

Authorized lab only. Do not attack others. Do not treat this RoE as permission to join a ransomware simulation on a hospital. Do not paste copyrighted vendor labs into the file. Do not title it “Official CEH v13 RoE.” If you already ran a scan on something you do not own, this lab does not launder that. Stop those activities. This file is forward-looking rules, not an indulgence.

Keep ceh-ethics-notes.txt, ceh-five-phases-notes.txt, and ceh-law-roe-notes.txt as siblings. They are not substitutes for ceh-roe.txt. The RoE is the operational page. If they contradict, the stricter out-of-scope list wins. chmod 600 all of them. Empty any file that still contains someone else’s secrets if you pasted those by mistake — deleting stolen data is cleanup, not covering tracks as a crime.

Run the block on a machine you own. Edit parentheticals. Re-run python3 check_ceh_roe.py until PASS. Then chmod 600. Do not add network tools. Do not point the checker at /etc/shadow. Windows: WSL/Git Bash, or create the same text file in your profile and restrict ACLs if chmod is missing.

for method in GET POST PUT DELETE OPTIONS; do
  curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
done

curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <TEST_TOKEN>" \
  -d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || cat

curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"

You now have a personal RoE that later lessons can point at: authorized lab only, locked notes, no practicing on other people’s systems, no fake certification claim. Next — Quiz — Ethical Hacking Intro — ten APPLY items on permission, the five-phase map, and legal scope. After the quiz, Passive Recon: What the Internet Already Says begins Module 2, still inside ceh-roe.txt, still original Cyberlium, still not a CEH exam dump.