Bug › Module 5 › Lesson 4
Lab — Asset Map
Pack asset map — inventory, JS/API, params/roles — literacy file only, dest $SCOPE_HOST.
Visual · bounty_map_lab
Lab: write asset map pack. $SCOPE_HOST only. Original Cyberlium.
Opening
Asset map before bug classes — scoped workbook on paper first.
Lessons 5-1 through 5-3 built inventory, JS/API checklist, and param/role tables. This lab merges them into one asset map workbook for $SCOPE_HOST. Optional: populate one row from recon if available — placeholders OK. No bug class testing required yet. Next: Quiz — Asset Mapping.
1. Lab contract: write the asset map workbook
Create $HOME/cyberlium-lab/t20-m05-l04-map-lab.txt merging inventory template, JS/API checklist, param/role table, and NEVER stranger lines.
Optional: one populated row for $SCOPE_HOST from recon — placeholders OK if offline.
Command guide
Try these commands — Lab contract: write the asset map workbook
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Asset map — fill AFTER subfinder/httpx/gau recon In-scope only — $SCOPE_HOST
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
macOS:
Command — copy this
brew install httpx
Windows:
Command — copy this
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" httpx -u "https://$SCOPE_HOST" -status-code -title -silent 2>/dev/null | tee "$HOME/cyberlium-lab/t20-asset-map.txt" || curl -sS -I "https://$SCOPE_HOST" | head -8 >> "$HOME/cyberlium-lab/t20-asset-map.txt" cat >> "$HOME/cyberlium-lab/t20-asset-map.txt" <<'EOF' hosts: urls: apis: params_of_interest: EOF
Command — copy this
grep -E 'hosts|params|http' "$HOME/cyberlium-lab/t20-asset-map.txt" | head -8
Primary tools to practice this lesson: grep, httpx. Reference sites: Asset map; In-scope only. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check mapping scope
Verify every row links to in-scope $SCOPE_HOST confirmation. Redact stranger URLs from drafts.
Tutorial asset maps on random domains get rewritten to YOUR program mentally.
3. Lock the proof
chmod 600 on workbook. Quiz next — then Bug Class Literacy.
Clean asset maps make Module 6 bug class testing focused and defensible.
4. What you ship: asset map workbook for $SCOPE_HOST
Inventory + JS/API + params/roles merged. $SCOPE_HOST only. NEVER stranger rows. chmod 600.
5. What you record before the next lesson
Date. Asset map path. Optional $SCOPE_HOST row. File t20-m05-l04-map-lab.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import classmate inventory rows. Skip file and fuzz random APIs.
Right
Write YOUR asset map for $SCOPE_HOST. chmod 600. Next: Quiz — Asset Mapping.
Mission: freeze YOUR asset map on disk
1) Merge inventory, JS/API, param/role sections. 2) Name $SCOPE_HOST as sole program root. 3) chmod 600. Never include stranger URLs.
Stuck? Ask Cyberlium AI Mentor
Asset maps beat ad-hoc testing when bug classes arrive.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Optional inventory rows must reference in-scope $SCOPE_HOST only.
True or False
Knowledge Check
APPLY: Asset map workbook combines:
Multiple choice