Bug › Module 2 › Lesson 1
Platforms
HackerOne, Bugcrowd, and similar platforms host programs — literacy on where YOUR $SCOPE_HOST policy lives.
Visual · bounty_platforms
Platform literacy. HackerOne/Bugcrowd named. $SCOPE_HOST only. Original Cyberlium.
Opening
Platforms are marketplaces for authorized research — not catalogs of random targets.
Bug bounty platforms like HackerOne and Bugcrowd connect researchers with organizations publishing vulnerability disclosure and bounty programs. Each program page lists scope, rules, safe harbor, and submission workflow. Enrollment means you accept those terms for that specific program — not every program on the platform. Cyberlium teaches platform literacy so you find YOUR enrolled program at $SCOPE_HOST. You will NOT browse public programs and test unlisted assets, or treat platform membership as permission to scan strangers. Next: Program Types.
1. What platforms provide
Platforms host program pages, scope documents, submission forms, triage communication, and payment rails. Researchers filter by technology, bounty range, and scope size — then enroll before testing.
HackerOne and Bugcrowd are named here for literacy only. Your obligation is to the specific program YOU joined listing $SCOPE_HOST — not the platform brand in general.
Command guide
Try these commands — What platforms provide
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
HackerOne programs — https://hackerone.com/directory/programs Bugcrowd programs — https://bugcrowd.com/engagements
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://hackerone.com/directory/programs | head -5 curl -sS 'https://httpbin.org/get?platform=literacy' | jq '.args'
Primary tools to practice this lesson: curl, jq. Reference sites: HackerOne programs (https://hackerone.com/directory/programs); Bugcrowd programs (https://bugcrowd.com/engagements). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Enrollment is per program
Accepting one program's rules does not authorize another. Each program has its own scope, rate limits, and safe harbor. Bookmark the exact URL for $SCOPE_HOST and re-read before sessions.
Platform reputation scores reward rule-followers. Scope violations can ban accounts — not a badge of honor.
3. Platforms are not target lists
Browsing 'new programs' for recon ideas on unenrolled assets is misuse. Pick programs deliberately, enroll, read scope — then test $SCOPE_HOST only.
Ship: platform name + program URL placeholder for YOUR $SCOPE_HOST enrollment. Next: Program Types.
4. What you ship: platform + program enrollment note
Name platform (HackerOne/Bugcrowd/etc.). Program URL for $SCOPE_HOST. NEVER unenrolled targets. chmod 600.
5. What you record before the next lesson
Date. Platform name. $SCOPE_HOST program URL note. File t20-m02-l01-platforms.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Scan every program on HackerOne 'for practice.' Test assets before clicking Accept.
Right
Document platform and YOUR $SCOPE_HOST enrollment. Next: Program Types.
Mission: document YOUR platform enrollment
1) Name the platform hosting YOUR program. 2) Write placeholder URL for $SCOPE_HOST program you joined. 3) Note enrollment date. 4) chmod 600. Never test before enrolling.
Stuck? Ask Cyberlium AI Mentor
Enrollment click is your contract — read before you accept.
Knowledge Check
APPLY: HackerOne/Bugcrowd platforms host:
Multiple choice
Knowledge Check
APPLY: True or False: Joining one program authorizes testing all programs on that platform.
True or False
Knowledge Check
APPLY: Before testing $SCOPE_HOST on a platform you should:
Multiple choice