Bug › Module 1 › Lesson 4
Lab — Rules Draft
Pack bounty rules + program enrollment note — literacy file only, dest $SCOPE_HOST / $LAB_HOST.
Visual · bounty_rules_lab
Lab: write bounty rules pack. $SCOPE_HOST / $LAB_HOST only. Original Cyberlium.
Opening
If the host is not $SCOPE_HOST in your enrolled program, offensive tools do not get it.
Lessons 1–3 defined bounty, safe harbor, and out-of-scope stops. This lab ships the artifact later modules reuse: a rules pack naming $SCOPE_HOST program you joined (or $LAB_HOST practice lab), allowed actions per policy, and NEVER lines for random sites, café Wi-Fi, classmate deploys, and out-of-scope hosts. No live exploit required — paperwork discipline bounty programs expect before any research session. Next: Quiz — Bounty Mindset and Rules.
1. Lab contract: write the rules pack first
Create $HOME/cyberlium-lab/t20-m01-l04-rules-lab.txt with date, operator, $SCOPE_HOST program name (or $LAB_HOST lab), allowed actions per policy, and NEVER list.
Optional: one-line proof you enrolled in the program or control $LAB_HOST — still no offensive run required in this lab.
Command guide
Try these commands — Lab contract: write the rules pack first
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
HackerOne — https://www.hackerone.com/ Bugcrowd — https://www.bugcrowd.com/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab" printf 'joined_program: never: OOS hosts, DoS ' > "$HOME/cyberlium-lab/t20-rules.txt" curl -sS -I --max-time 8 https://www.hackerone.com/ | head -10 grep never "$HOME/cyberlium-lab/t20-rules.txt"
Primary tools to practice this lesson: curl. Reference sites: HackerOne (https://www.hackerone.com/); Bugcrowd (https://www.bugcrowd.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep your notes for stranger URL examples and redact them to $SCOPE_HOST. If a tutorial screenshots a random shop domain, rewrite mentally to $SCOPE_HOST before you copy habits.
Classmates run their own enrolled programs; do not 'share targets' by testing each other's deploy URLs.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Platforms and Programs.
Bounty teams archive program policy with findings; you are practicing that archive habit early.
4. What you ship: bounty rules pack for $SCOPE_HOST
Rules pack names $SCOPE_HOST or $LAB_HOST. NEVER lines present. chmod 600. No random-site testing.
5. What you record before the next lesson
Date. Rules pack path. $SCOPE_HOST enrollment note. File t20-m01-l04-rules-lab.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add a classmate's deploy URL 'as a second target.' Skip the file and recon anyway.
Right
Write YOUR rules pack for $SCOPE_HOST / $LAB_HOST. chmod 600. Next: Quiz — Bounty Mindset and Rules.
Mission: freeze YOUR bounty rules on disk
1) Write rules pack with program/lab, allowed actions, NEVER list. 2) Name $SCOPE_HOST or $LAB_HOST. 3) Optional enrollment proof line. 4) chmod 600. Never list stranger URLs.
Stuck? Ask Cyberlium AI Mentor
Rules packs are boring on purpose — boring saves platform accounts and keeps strangers' sites alone.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on bounty notes.
True or False
Knowledge Check
APPLY: A tutorial tests a random public domain. You:
Multiple choice