Bug › Module 6 › Lesson 4
Lab — Classes
Document bug-class literacy on $LAB_BOUNTY or enrolled $PROGRAM test asset — classify findings, minimal proof, no weaponized chains.
Visual · t20_classes_lab
Lab: name bug classes on scope or $LAB_BOUNTY. Original Cyberlium.
Opening
One lab app, three class hypotheses, minimal proof each — not a trophy wall from random internet hosts.
On YOUR $LAB_BOUNTY intentional app or enrolled $PROGRAM asset per brief: (1) from asset map pick three endpoints; (2) for each, document one bug-class hypothesis (XSS, IDOR, SSRF/redirect, or logic) with source→sink or authZ reasoning — no full exploit cookbook; (3) if brief allows validation, capture minimal proof (harmless XSS marker, one ID swap diff, one redirect to your controlled URL) — stop at proof, no bulk exfil; (4) write defender paragraph per class. chmod 600 notes in $HOME/cyberlium-lab. No testing unenrolled production, no DoS, no phishing, no metadata pivot scripts on stranger cloud.
1. Lab setup
Verify hostname is $LAB_BOUNTY or listed in $PROGRAM scope before any request.
Use disposable test accounts you created — not real customer accounts or scraped credentials.
Command guide
Try these commands — Lab setup
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Bug classes notes — XSS, IDOR, SSRF, logic httpbin.org/get — safe request shaping demos
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t20-bug-classes.txt" <<'EOF' xss: injection into HTML/JS context (literacy) idor: access object IDs across users/roles ssrf: server fetches attacker-controlled URL never: blast random sites; stay in published scope EOF
Command — copy this
curl -sS 'https://httpbin.org/get?bug_class=idor_demo&id=100' | jq '.args.id' grep idor "$HOME/cyberlium-lab/t20-bug-classes.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: Bug classes notes; httpbin.org/get. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Deliverables
Three class cards: hypothesis, hunter reasoning, defender fix, proof status (validated or literacy-only per brief).
Redact tokens and PII — synthetic lab data only in screenshots.
3. Stop conditions
Stop at minimal proof — no downloading other users' objects, no internal network maps via SSRF beyond brief.
If asset is not in scope file, stop and document blocker — do not 'just try' stranger subdomains.
4. What you ship: bug class lab pack
Three class cards with defender notes + minimal proof or honest literacy-only — chmod 600.
5. What you record before the next lesson
Classes lab notes path.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Chain XSS→SSRF→metadata on unenrolled SaaS and paste in Discord.
Right
Three class cards on scope or $LAB_BOUNTY. Next: quiz.
Mission: classes lab
1) Pick three in-scope endpoints. 2) Write class hypothesis + defender note each. 3) Minimal proof if brief allows. 4) Secure notes chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Literacy-only vs validated — which for my brief?”
Knowledge Check
APPLY: Classes lab target:
Multiple choice
Knowledge Check
APPLY: True or False: Full exploit chains on strangers belong in class lab.
True or False
Knowledge Check
APPLY: Class lab pack includes:
Multiple choice