Bug › Module 3 › Lesson 1
Reading Scope
Scope documents name targets, methods, and limits — read YOUR program scope for $SCOPE_HOST before any probe.
Visual · bounty_reading_scope
Reading scope literacy. $SCOPE_HOST only. Original Cyberlium.
Opening
Scope is the contract boundary. If the asset is not listed, the tool stays holstered.
Program scope names in-scope assets ($SCOPE_HOST and related URLs), allowed techniques, authentication requirements, data handling rules, and escalation contacts. Scope changes over time — researchers re-read before each session. Vague scope creates legal risk and neighbor harm when students scan random sites. Cyberlium teaches scope reading on YOUR enrolled program — not scope laundering to justify café Wi-Fi or classmate targets. Next: In vs Out.
1. Scope elements bounty hunters expect
Targets: domains, subdomains, apps, mobile apps, API bases listed for $SCOPE_HOST. Methods: passive vs active recon limits, automated scanning caps, forbidden social engineering. Evidence: where notes live ($HOME/cyberlium-lab, chmod 600).
Professional scopes also name third parties and wildcard rules (*.example.com may include or exclude assets — read carefully).
Command guide
Try these commands — Scope elements bounty hunters expect
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Scope parsing — in_scope / out_of_scope from program policy Wildcard scope — *.example.com literacy
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Parse: domains, IPs, APIs, mobile apps — only what program lists')"
curl -sS https://httpbin.org/headers | head -15Primary tools to practice this lesson: curl, grep. Reference sites: Scope parsing; Wildcard scope. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Read scope like a lawyer, test like a researcher
Highlight in-scope URLs, out-of-scope bullets, rate limits, and testing account rules. Copy scope date into notes. If $SCOPE_HOST appears twice with different tiers, note which tier applies.
Tutorials showing public domains get rewritten to YOUR $SCOPE_HOST before copying workflow.
3. Scope on paper, not in chat
Discord 'just try this subdomain' is not scope amendment. Official program updates and email from triage change scope — chat paste does not.
Ship: scope summary table — in-scope, out-of-scope, rate limits for $SCOPE_HOST. Next: In vs Out.
4. What you ship: scope summary for $SCOPE_HOST
In-scope list, out-of-scope bullets, rate limits, scope date. $SCOPE_HOST named. chmod 600.
5. What you record before the next lesson
Date. Scope summary. $SCOPE_HOST named. File t20-m03-l01-reading-scope.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Scope = 'everything on the internet.' Add classmate URL because chat said so.
Right
Write scope summary for $SCOPE_HOST only. Next: In vs Out.
Mission: summarize YOUR program scope
1) List in-scope assets for $SCOPE_HOST. 2) Copy three out-of-scope lines from policy. 3) Note scope date and rate limits. 4) chmod 600. Never add stranger hosts without official scope update.
Stuck? Ask Cyberlium AI Mentor
Scope summaries save you from 'I thought that subdomain counted.'
Knowledge Check
APPLY: Program scope should name:
Multiple choice
Knowledge Check
APPLY: True or False: Discord paste can amend official program scope.
True or False
Knowledge Check
APPLY: Before each bounty session on $SCOPE_HOST you should:
Multiple choice