Steps and Impact
Numbered reproduction and honest impact writing for $PROGRAM reports — chain literacy without weaponized cookbooks.
Visual · t20_steps_and_impact
Steps = replayable; impact = business harm in program context. Original Cyberlium.
Steps let triage replay; impact explains why the patch matters — both stay proportional and in-scope.
Reproduction steps: start from clean state, list account type, exact HTTP method/path/parameter, expected vs actual, one minimal proof attachment reference. Impact: who can abuse this, what data or action is at risk, whether admin or unauthenticated, realistic chaining on $PROGRAM assets — describe without executing destructive chains on strangers. Distinguish demonstrated vs theoretical impact honestly; triagers respect 'likely account takeover with one token' when proof shows IDOR on session object — you do not need to compromise every user. No step-by-step weaponized cookbooks for copying against unenrolled sites. Map impact language to program severity definitions, not inflated CVSS theater.
1. Step writing rules
Number every step; include burp/curl summary redacted; note which steps require auth.
Stop steps at proof — do not continue into 'then dump entire database.'
Command guide
Try these commands — Step writing rules
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence — httpx/subfinder output cited in report Redact — no unnecessary PII
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
macOS:
Command — copy this
brew install httpx
Windows:
Command — copy this
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" httpx -u "https://$SCOPE_HOST" -status-code -silent 2>/dev/null | head -5 || curl -sS -I "https://$SCOPE_HOST" | head -5 grep steps "$HOME/cyberlium-lab/t20-report-draft.txt" 2>/dev/null || echo 'steps_to_reproduce: (from recon)'
Primary tools to practice this lesson: grep, httpx. Reference sites: Evidence; Redact. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Impact writing rules
State attacker prerequisites, affected object type, confidentiality/integrity/availability in plain language.
Chain thoughts: XSS + CSRF on same app may raise impact — label as theoretical if not demonstrated.
3. Honesty boundary
Do not claim RCE without proof; do not understate IDOR on payment objects.
If impact is limited to self, say so — program may classify informational; honesty beats inflation.
4. What you ship: steps and impact template
Numbered steps block + impact paragraph template + demonstrated vs theoretical labels.
5. What you record before the next lesson
Steps and impact template path.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Write impact claiming full domain takeover without repro beyond open redirect.
- Right: Steps and impact template written. Next: Severity and Fix.
Mission: steps and impact template
1) Draft numbered steps skeleton. 2) Write impact paragraph template. 3) Add demonstrated vs theoretical labels. 4) Link minimal proof attachment rule.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “When is theoretical chaining OK in impact?”
APPLY: Repro steps should be:
APPLY: True or False: Inflate impact for higher bounty always works.
APPLY: Impact paragraph states:
Severity and Fix
Part of Bug Bounty Hunting with AI — Report Writing.
Lab — Report Draft
Part of Bug Bounty Hunting with AI — Report Writing.
Quiz — Reports
Part of Bug Bounty Hunting with AI — Report Writing.