Notes: scope, command, result, time

02Four lines and a cleanup

Write scope as target, permitted action, agreed time window and stopping condition. Copy an actual command exactly if one was run; otherwise state that you read a model. Quote the relevant result and label its origin. Record the event date and zone or UTC offset, and leave missing information explicitly unknown.

Keep cleanup in the same note so configuration does not remain a hidden dependency. For a later proxy session, record what happened to the lab browser’s proxy setting and any CA trust. Before sharing a note, remove passwords, session-cookie values and private flags. Redaction replaces sensitive content with a label while retaining useful structure, such as a header name.

1Scope: owned loopback, TCP port 8000, connect only
2Action: read the supplied scan model
3Result: 8000/tcp open — synthetic
4Time attached to this worked model: 2026-10-12 14:00 UTC
5Limit: connection acceptance does not establish unsafe behavior.

03Finish the activity note

The activity note supplies a scan model and a partial timestamp. Copy facts faithfully instead of inventing a missing zone from your own location.

Copy this shape. Fill it from the evidence in front of you.
A synthetic row stays labeled synthetic.

Scope
Target:
Allowed action:
Time window:
Stop:

Command
Exact line:
What you did not run:

Result
Quote:
Label: synthetic model, or observed output
What this result does not prove:

Time
Stamp, with a date and a timezone:

Cleanup
Proxy and browser returned to their ordinary settings:

Activity note. The scan row is the synthetic model from the Nmap lesson.
This note is not the 2026-10-12 loopback transcript.

Scope
Target: 127.0.0.1
Allowed action: one TCP connect probe of port 8000
Stop: no other port and no other host

Command
nmap -sT -p 8000 127.0.0.1
Version detection was not part of the command.

Result
8000/tcp open
Label: synthetic model
This row does not prove a vulnerability.

Time
2026-10-12 09:00

Check: the date is present. The timezone is missing.
Leave the missing zone explicit and request it from the source in your notes.

1. Copy the stated target, command under discussion and synthetic result into the template. Distinguish reading this card from executing its command.
2. Compare the date-bearing activity time 2026-10-12 09:00 with the worked UTC stamp. Mark timezone missing; do not supply one by assumption.
3. Write a follow-up question asking the note’s source to provide the zone and clock basis. That is a request you put in notes, not a message you send during the lesson.
4. Stop once each section is filled or explicitly unknown. No scan is needed to repair a documentation gap.

04Tools case

Combine the supplied cable, transform, request, crawler-rule and scan evidence into one note. The six observations share a method: quote the evidence, identify its source, then separate the conclusion from what remains unknown.

Tools stage synthesis. Write a short evidence note; this worksheet is ungraded.
Original models. No browser, CyberChef bake, proxy, or Nmap run was observed.
Write six lines. The rubric is on this card.

1. Page
Source sentence: Bring the spare cable.
A local Elements edit shows: Bring the spare lamp.
After a reload of the unchanged file, the sentence is: Bring the spare cable.
Rubric: name browser developer tools. The file still says cable. The edit lived in the browser.

2. Transform
Input: 6c616d70
The characters are hex digits.
Rubric: one From Hex step. Predicted plain text: lamp.
Python's standard library produced that prediction while this card was written.
Magic is a hypothesis until the step is written down.

3. Proxy
Held request: GET /cable HTTP/1.1, Host: 127.0.0.1:8000
Rubric: name the control from the proxy lesson that sends this held request.
Then write the cleanup: intercept or global break off, lab browser proxy cleared, everyday browser left without a lab CA.
Keep this request a model; sending it is unnecessary.

4. Recon
A file in this case says Disallow: /private/
A link on the same card names cable.txt.
Rubric: cable.txt is a clue you were given. The Disallow line is a request to crawlers. It does not grant a test.

5. Scan model
127.0.0.1 port 8000, row 8000/tcp open, labeled synthetic.
Rubric: the row records a listener in the model. It does not by itself prove a vulnerability.

6. Time
Stamp on the bad note: 2026-10-12T09:00:00
Rubric: the date is present and the timezone is missing.
Do not fill the missing zone by assuming your own location.

Stop when the six lines are written. Do not start a tool to finish the case.

1. Use the stage case’s cable sentence to distinguish a DOM edit from its saved file. Use its hex mapping to record a one-step transformation and result.
2. For the held GET /cable model, describe the proxy release and cleanup without sending it. For Disallow: /private/, identify its crawler audience and consult the separate grant.
3. Label the scan row synthetic and limit its claim to connection acceptance. Compare the compact timestamp with the worked UTC example and mark any missing zone.
4. Stop after six short observations. Review whether a reader could locate every fact and tell model from observation.

05Where this stage stops

You can now choose a tool by its job, read the evidence it supplies and state what it leaves unknown. Hands-on browser, CyberChef, proxy and Nmap practice can wait for a suitable owned lab; these paper traces establish reasoning rather than tool operation.

The next stage applies those habits to web failures. Carry forward a scoped question, an exact request or state model, a clear evidence limit and a cleanup plan. An installed tool never expands permission.

06Optional challenge

In about ten optional minutes, redact the fictional header Cookie: session=amber-42. Keep the name Cookie and replace the session value with redacted. Add a note that a value was omitted; that makes the edit visible without disclosing the original.

07Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Grant: owned 127.0.0.1, port 8000, one scoped TCP connect scan only.
Action card: nmap -sT -p 8000 127.0.0.1
Result card: 8000/tcp filtered
Provenance: synthetic row, no scan run.
Time attached by the author: 2026-10-21 10:25
Stop: no additional scan or destination.

Saved HTML: <p>Collect the blue folder.</p>
Local DOM edit only: Collect the green folder.
Encoding provenance: hex once. Input 6f6172; map 6f=o, 61=a, 72=r.
A held GET /folder at 127.0.0.1:8000 is described on paper; it was not sent.
No saved-file write, response or tool run is recorded.

08Explain your evidence

Optional written self-check: explain one decision using the supplied case. No tool run is required.

Check your explanation: record scope, exact action, result, provenance and missing time zone; distinguish DOM state, transformation prediction and proxy state; omit invented observations and secrets.