Bug › Module 1 › Lesson 3
Never Out of Scope
Out-of-scope is a hard stop — name what you will NEVER touch beyond $SCOPE_HOST / $LAB_HOST.
Visual · bounty_never_oos
Never OOS. $SCOPE_HOST / $LAB_HOST only. Original Cyberlium.
Opening
Professional bounty hunters spend as much time on what they will NOT test as what they will.
Out-of-scope assets include: third-party SaaS, payment processors, employee personal accounts, physical locations, unrelated business units, and any host not listed — dorm LANs, café Wi-Fi, classmate deploy URLs, random trending domains. Stopping when you hit out-of-scope is core skill, not failure. Cyberlium treats out-of-scope as hard stops. You will NOT 'just peek' at a classmate's project because recon tools make it easy. Next: Rules Lab.
1. Common out-of-scope categories in bounty programs
Third-party infrastructure (CDN edges you do not own, payment gateways), out-of-band systems (corporate VPN, internal AD unless listed), destructive attacks (DoS, data wipe), and social engineering against staff unless explicitly in scope.
Your personal NEVER list: anything not $SCOPE_HOST in your enrolled program or $LAB_HOST in your practice lab — dorm subnets, café Wi-Fi, classmate hackathon URLs, employer production without listing.
Command guide
Try these commands — Common out-of-scope categories in bounty programs
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Program selection — join ONE program; read scope first Rate limits — respect program throttling
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Never: out-of-scope hosts, DoS, phishing, data destruction')"
curl -sS https://docs.hackerone.com/ | head -5Primary tools to practice this lesson: curl, python3. Reference sites: Program selection; Rate limits. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Stop means stop — ask, do not pivot
If recon reveals a subdomain outside scope, note it and stop — do not probe. Enterprise programs expect researchers to request scope clarification through official channels. In Cyberlium, you redact stranger URLs from notes and return to $SCOPE_HOST.
Curiosity without stop discipline is how students become unauthorized access cases and lose platform accounts.
3. Out-of-scope protects you and strangers
Written exclusions defend researchers in triage disputes and protect neighbors from collateral scanning. chmod 600 notes that say NEVER dorm/café/classmate/random-site.
Ship: out-of-scope bullet list for YOUR bounty work. Next: Rules Lab.
4. What you ship: out-of-scope NEVER list
List categories and hard stops. $SCOPE_HOST / $LAB_HOST only in-scope. NEVER random sites, café, classmates. chmod 600.
5. What you record before the next lesson
Date. Out-of-scope bullets. $SCOPE_HOST in-scope reaffirmed. File t20-m01-l03-never-oos.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pivot to roommate's deploy URL 'because it responded.' Add Shodan results to scope mid-session.
Right
Write out-of-scope NEVER list. Stop at boundary. Next: Rules Lab.
Mission: freeze out-of-scope stops
1) Write five out-of-scope categories for YOUR bounty work. 2) Include dorm LANs, café Wi-Fi, classmate deploys, random trending sites. 3) chmod 600. Stop when target is not $SCOPE_HOST or $LAB_HOST.
Stuck? Ask Cyberlium AI Mentor
Out-of-scope is permission to say no — use it before tools touch strangers.
Knowledge Check
APPLY: You discover a subdomain outside program scope while researching $SCOPE_HOST. You:
Multiple choice
Knowledge Check
APPLY: True or False: Out-of-scope lists are optional in professional bounty work.
True or False
Knowledge Check
APPLY: Cyberlium out-of-scope includes:
Multiple choice