# curl lab helpers — Tech Forge

Safe local stubs for practicing **curl flags** that show up in CEH-style web/API/cloud modules.  
Run these on **your own Linux VM**. They bind to `127.0.0.1` only.

## Requirements
- Python 3.8+
- `curl` (and optionally `jq`)

## fake-metadata.py
Mimics common cloud metadata *path shapes* (AWS IMDS-style and GCP Metadata-Flavor header).  
**Never** point students at real `169.254.169.254` or GCP metadata from home networks.

```bash
python3 fake-metadata.py
# separate terminal:
curl -s http://127.0.0.1:9090/latest/meta-data/
curl -s -H 'Metadata-Flavor: Google' http://127.0.0.1:9090/computeMetadata/v1/instance/id
```

## mini-ssrf.py
Tiny `/fetch?url=` app that only allows `httpbin.org` and localhost — practice the *client* side of an SSRF-shaped request.

```bash
python3 mini-ssrf.py
curl -s 'http://127.0.0.1:9091/fetch?url=https://httpbin.org/get'
curl -s 'http://127.0.0.1:9091/fetch?url=https://example.com/'   # blocked
```

## sample.json / sample.txt
Use with multipart upload practice:

```bash
curl -s -F 'file=@sample.json' https://httpbin.org/post | jq .
```

## Ethics
Practice flags on systems you own or that invite testing (httpbin, example.com, these stubs).  
No attacking third parties. Course hands-on attack labs stay in authorized CEH iLabs.

Live course: https://www.techforge.community/curl/

## health_stub.py
Tiny JSON health endpoint for probe practice.

```bash
python3 health_stub.py
curl -s http://127.0.0.1:9092/ | jq .
```