Bug › Module 5 › Lesson 3
Params and Roles
Parameters and roles define test surfaces — map only on in-scope $SCOPE_HOST with program account rules.
Visual · bounty_params_and_roles
Params and roles literacy. $SCOPE_HOST only. Original Cyberlium.
Opening
Every parameter is not invitation to fuzz strangers — scope and account rules first.
Parameter mapping lists query keys, POST fields, headers, and role-based access (guest vs user vs admin) on in-scope endpoints. Bounty programs often provide test accounts or forbid testing on live user data. Role literacy prevents IDOR and logic tests from crossing into privacy violations. Cyberlium teaches param/role tables on $SCOPE_HOST inventory rows — not credential tests on café login or classmate apps. Next: Map Lab.
1. Parameter inventory per endpoint
For each in-scope $SCOPE_HOST endpoint: list params (query/body/header), type guess, auth required, role tested, notes. Build from JS review and manual browsing — not blind fuzz on production beyond rate limits.
Parameter pollution on out-of-scope hosts is out — stay on inventory rows marked in-scope.
Command guide
Try these commands — Parameter inventory per endpoint
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
URL gathering — gau for parameter discovery literacy Stay in scope — domain from t20-scope.env
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl go install github.com/lc/gau/v2/cmd/gau@latest
macOS:
Command — copy this
go install github.com/lc/gau/v2/cmd/gau@latest
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
go install github.com/lc/gau/v2/cmd/gau@latest
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" gau "$(cat "$HOME/cyberlium-lab/t20-root-domain.txt" 2>/dev/null || echo httpbin.org)" 2>/dev/null | head -20 || curl -sS "https://$SCOPE_HOST/get?foo=bar&baz=1" | jq '.args'
Primary tools to practice this lesson: curl, gau. Reference sites: URL gathering; Stay in scope. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Role-based testing boundaries
Use program-provided test accounts when available. Do not access other users' data on $SCOPE_HOST to 'prove' IDOR — minimal proof per policy. Horizontal privilege tests stay on accounts you own or program supplies.
Testing admin functions without authorization violates most programs — read role rules.
3. Params and roles feed bug classes
Module 6 attaches XSS to reflected params, IDOR to object IDs, logic flaws to role transitions — all from this table on $SCOPE_HOST only.
Ship: param/role table template linked to inventory. Next: Map Lab.
4. What you ship: param/role table for $SCOPE_HOST
Columns: endpoint, param, auth, role, in-scope. Test accounts per policy. $SCOPE_HOST only. chmod 600.
5. What you record before the next lesson
Date. Param/role template. $SCOPE_HOST named. File t20-m05-l03-params-and-roles.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Fuzz params on classmate API. Access random user IDs on production $SCOPE_HOST 'for IDOR proof.'
Right
Write param/role table template for $SCOPE_HOST. Next: Map Lab.
Mission: template param/role table
1) Define param/role columns. 2) Link to inventory row for $SCOPE_HOST. 3) Note test account rules from policy. 4) chmod 600. Never test roles on out-of-scope apps.
Stuck? Ask Cyberlium AI Mentor
Minimal proof on owned test accounts beats data harm.
Knowledge Check
APPLY: Parameter mapping in Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: IDOR testing may require using other users' live data without policy permission.
True or False
Knowledge Check
APPLY: Program test account rules for $SCOPE_HOST:
Multiple choice