Lab Path
Hunting path diagram for YOUR $PROGRAM or $LAB_BOUNTY — recon to report, RoE boundaries marked.
Visual · t20_lab_path
Lab path = visual hunt chain on in-scope assets. Original Cyberlium.
Draw the path you actually took on enrolled scope — not a fantasy map through stranger infrastructure.
Document bounty path from scope read → asset map → class hypothesis → validation (minimal proof) → report draft → mock triage: diagram or numbered steps with hostnames from $PROGRAM scope or $LAB_BOUNTY, evidence row IDs, and stop boundaries. Mark where dup/noise filter removed dead ends. Include defender breakpoint: where encoding, authZ, or WAF would alter path. No paths through unenrolled subdomains, no 'then SSRF to metadata' on assets outside rules. Mermaid or sketch chmod 600 in private notes.
1. Path elements
Enrollment/scope, recon row, mapped endpoint, class tested, validation outcome, report ID, triage state fiction or live.
Each step links checklist row and evidence index entry.
Command guide
Try these commands — Path elements
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Recon review — httpx live check on scope host Asset map completeness
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest sudo apt install curl
macOS:
Command — copy this
brew install httpx
Windows:
Command — copy this
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" httpx -u "https://$SCOPE_HOST" -status-code -title -silent 2>/dev/null | head -5 curl -sS "https://$SCOPE_HOST/get?capstone=review" 2>/dev/null | jq '.args' || curl -sS 'https://httpbin.org/get?capstone=review' | jq '.args'
Primary tools to practice this lesson: httpx, curl. Reference sites: Recon review; Asset map completeness. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Boundary overlay
Draw OOS line — subdomains not in scope, prohibited actions (DoS, social eng).
Note program rate limits respected Y/N.
3. Defender breakpoints
Mark controls that would block path: CSP, authZ, egress filter for SSRF.
Honest N/A if live validation not performed — literacy path still valid on $LAB_BOUNTY.
4. What you ship: lab path diagram
Hunt path diagram with scope border + defender breakpoints — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Draw path including unenrolled competitor API mass scan.
- Right: Lab path documented. Next: Evidence Pack.
Mission: lab path diagram
1) Map steps from scope to report on your path. 2) Mark OOS boundary. 3) Add two defender breakpoints. 4) Link evidence rows.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
APPLY: Lab path documents:
APPLY: True or False: OOS mass scan belongs on path diagram.
APPLY: Path should show:
Evidence Pack
Part of Bug Bounty Hunting with AI — Capstone and Topic Quiz.
Lab — Capstone
Part of Bug Bounty Hunting with AI — Capstone and Topic Quiz.
Quiz — Bug Bounty Hunting Topic
Part of Bug Bounty Hunting with AI — Capstone and Topic Quiz.