Bug › Module 7 › Lesson 4
Lab — Validate
Run validation hygiene on $LAB_BOUNTY or enrolled scope — minimal proof, no harm, dup check, pre-submit pack.
Visual · t20_validate_lab
Lab: validation hygiene workflow on scope. Original Cyberlium.
Opening
Practice the full validation pipeline on an asset you are allowed to touch — not on production strangers.
On $LAB_BOUNTY or one enrolled $PROGRAM asset per brief: (1) pick one bug-class hypothesis from Module 6; (2) validate with minimal proof — redacted HTTP, stop after first foreign object or one XSS marker; (3) complete no-data-harm checklist — document data touched (synthetic only); (4) run dup/noise check — search platform dupes or mark lab N/A; (5) draft pre-submit validation summary (not full public report yet). chmod 600 in $HOME/cyberlium-lab. No destructive tests, no mass scans, no submissions on unenrolled targets. If validation would harm real users, stop at literacy paragraph and describe impact in words.
1. Validation pipeline
Scope verify → minimal repro → harm check → dup search → pre-submit summary.
Each step gets one checkbox row in notes with UTC timestamp.
Command guide
Try these commands — Validation pipeline
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Proof lab — curl query params; no stranger targets HackerOne report guide — https://docs.hackerone.com/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env"
curl -sS "https://$SCOPE_HOST/get?param=recon_followup" 2>/dev/null | jq '.args' || curl -sS 'https://httpbin.org/get?param=recon_followup' | jq '.args'
python3 -c "print('Minimal proof: reproduce in 3–5 steps on in-scope host')"Primary tools to practice this lesson: curl, jq. Reference sites: Proof lab; HackerOne report guide (https://docs.hackerone.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Redact tokens, emails, phone numbers — use testuser+lab@yourdomain if program allows.
Store proof attachments local chmod 600 — not public paste bins with live cookies.
3. Stop and escalate
If dup found, document root cause comparison — do not re-submit same bug.
If OOS, move hypothesis to backlog for different program — do not test anyway.
4. What you ship: validation lab pack
Pipeline checklist completed + minimal proof redacted + dup/noise result + data-touched line.
5. What you record before the next lesson
Validate lab pack path.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Validate IDOR by exporting entire user table on unenrolled API.
Right
Validation lab pack on scope or $LAB_BOUNTY. Next: quiz.
Mission: validate lab
1) Run full validation pipeline on one bug. 2) Attach minimal redacted proof. 3) Dup/noise check documented. 4) Secure notes chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “When to stop at impact description only?”
Knowledge Check
APPLY: Validate lab uses:
Multiple choice
Knowledge Check
APPLY: True or False: Skip dup search to submit faster.
True or False
Knowledge Check
APPLY: Validation pack includes:
Multiple choice