Bug › Module 7 › Lesson 1
Minimal Proof
Prove impact with the smallest sufficient evidence on $PROGRAM scope — one step, redacted, reproducible for triage.
Visual · t20_minimal_proof
Minimal proof = enough for triage, not maximum damage. $PROGRAM only. Original Cyberlium.
Opening
Triagers want clarity, not carnage — one redacted screenshot beats a folder of stranger user data.
Bug bounty validation proves the vulnerability exists and shows plausible impact without unnecessary harm. Minimal proof: reproduce once, capture redacted HTTP exchange or screenshot, describe attacker prerequisites, stop — do not exfiltrate entire databases, scrape all users, or leave persistent backdoors on in-scope assets. Hunters ask: 'What is the smallest request that demonstrates the bug?' Programs and laws care about proportionality; your reputation cares too. Cyberlium teaches proof discipline on YOUR $PROGRAM submissions or $LAB_BOUNTY — not trophy hunts dumping PII, not 'impact proof' that destroys data, not video recordings of real customer sessions without program permission.
1. Proof building blocks
Steps numbered, request/response summary redacted, before/after state for IDOR/logic, single XSS execution marker.
Prerequisites: account level, feature flag, endpoint from asset map — triager can replay safely.
Command guide
Try these commands — Proof building blocks
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Minimal proof — one clear step list on in-scope only Refuse — exfil PII, DoS, phishing
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" 2>/dev/null || SCOPE_HOST=httpbin.org
curl -sS "https://$SCOPE_HOST/get?proof=minimal" | jq '.url' | head -c 80
python3 -c "print('Check duplicates before filing on platform')"Primary tools to practice this lesson: curl, jq. Reference sites: Minimal proof; Refuse. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What to omit
No full CSV exports, no thousands of IDs, no live session tokens in public reports, no internal network maps beyond brief.
If impact is Critical, describe blast radius in words — prove with one object or one row, not the whole table.
3. Scope discipline
Validate only on enrolled $PROGRAM assets or $LAB_BOUNTY — read program safe-harbor and testing rules first.
Stop when triage-ready — extra damage does not increase reputation; it increases bans and legal risk.
4. What you ship: minimal proof template
Proof template: steps, redacted exchange, prerequisites, stop condition + $PROGRAM scope line.
5. What you record before the next lesson
Minimal proof template path.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Download 10,000 user records to 'show impact' on an IDOR.
Right
Minimal proof template written. Next: No Data Harm.
Mission: minimal proof template
1) Write numbered repro steps skeleton. 2) List redaction rules for tokens/PII. 3) Define stop condition after first proof. 4) Tie to $PROGRAM scope only.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Blurred screenshot vs raw HTTP — program preference?”
Knowledge Check
APPLY: Minimal proof means:
Multiple choice
Knowledge Check
APPLY: True or False: Dumping all users proves IDOR better.
True or False
Knowledge Check
APPLY: Proof should include:
Multiple choice