Inventory
Asset inventory lists hosts, apps, and endpoints from recon — map only in-scope $SCOPE_HOST findings.
Visual · bounty_inventory
Inventory literacy. $SCOPE_HOST only. Original Cyberlium.
Inventory turns recon noise into a test plan — scoped rows only.
Asset mapping starts with an inventory: hostnames, apps, endpoints, technologies, and auth requirements discovered on in-scope $SCOPE_HOST assets. Each row links back to scope confirmation and recon source. Inventories exclude out-of-scope neighbors and third-party widgets. Cyberlium teaches inventory discipline without cataloging classmate deploys or random sites. You build rows from YOUR recon pack only. Next: JS and APIs.
1. Inventory columns that matter
Hostname, in-scope Y/N, app type (web/API/mobile), tech hints, auth required, recon source, next test idea. Start with $SCOPE_HOST root and confirmed subdomains only.
Empty rows beat fabricated findings. Honest gaps invite targeted recon — not scope violations.
Command guide
Try these commands — Inventory columns that matter
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GAU — https://github.com/lc/gau (archived URLs — in-scope domain) Wayback literacy — historical endpoints in scope
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install github.com/lc/gau/v2/cmd/gau@latest sudo apt install curl
macOS:
Command — copy this
go install github.com/lc/gau/v2/cmd/gau@latest
Windows:
Command — copy this
go install github.com/lc/gau/v2/cmd/gau@latest
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" gau --subs "$(cat "$HOME/cyberlium-lab/t20-root-domain.txt" 2>/dev/null || echo httpbin.org)" 2>/dev/null | head -20 || curl -sS "https://$SCOPE_HOST/links/10/0" | head -10
Primary tools to practice this lesson: gau, curl. Reference sites: GAU (https://github.com/lc/gau); Wayback literacy. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. One inventory per program
Keep separate inventories per enrolled program. Mixing $SCOPE_HOST rows with classmate URLs creates audit nightmares and policy violations.
chmod 600 inventory files under $HOME/cyberlium-lab — same as recon notes.
3. Inventory feeds bug class testing later
Module 6 bug classes attach to inventory rows — XSS on listed forms, IDOR on API paths you mapped here. Out-of-scope rows never get test ideas.
Ship: inventory table header for $SCOPE_HOST. Next: JS and APIs.
4. What you ship: inventory table template for $SCOPE_HOST
Columns: hostname, in-scope, app type, tech, auth, source, next step. $SCOPE_HOST only. chmod 600.
5. What you record before the next lesson
Date. Inventory template. $SCOPE_HOST named. File t20-m05-l01-inventory.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Add every Shodan host to inventory. Mix classmate deploy rows 'for comparison.'
- Right: Write inventory template for $SCOPE_HOST. Next: JS and APIs.
Mission: template asset inventory
1) Define inventory columns. 2) Add $SCOPE_HOST as first row placeholder. 3) chmod 600. Never inventory stranger hosts.
Stuck? Ask Cyberlium AI Mentor
Scoped inventory beats thousand-row unfocused lists.
APPLY: Asset inventory in Cyberlium includes:
APPLY: True or False: Out-of-scope discovered hosts belong in inventory with in-scope=N.
APPLY: Inventory rows should link to: