Web › Module 1 › Lesson 4
Lab — Bug Bounty Finding Demo (A01)
DEMO: fictional bounty program → IDOR on http://192.168.0.1/ → severity → report.
Visual · bounty_finding_demo_a01
Bug bounty student demo: scope → curl → report. If that IP is a home router login, STOP and
Opening
DEMO for bounty students: the paycheck skill is the report — not a random-site payload pack.
Lessons 1–3 named OWASP Top 10:2025 A01. This lab is a **bug bounty workflow demo** with practical commands against This is ORIGINAL Cyberlium teaching for students who want paid reports later — not an invitation to hunt strangers, not official HackerOne/Bugcrowd training, not official OWASP certification. Live production, café targets, campus portals, and “any SaaS login” are out. Topic 20 (Bug Bounty Hunting) goes deeper later; this demo installs the habit now. Next: Quiz — Broken Access Control.
1. Step 0 — Fictional program scope (read before you curl)
Pretend Cyberlium Lab Bounty v1 published this policy. In scope: and the local bind http://127.0.0.1:8765 of the same teaching process. Out of scope: home router admin, cloud metadata, roommate LAN sweeps, SaaS you do not own, DoS, social engineering. If curl of http://192.168.0.1/ shows TP-Link/Netgear/Huawei “Router Admin,” that host is OUT — switch to
Command guide
A01 BAC — Step 0 - Fictional program scope (read before you curl)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
2. Step 1 — Reproduce on YOUR loopback (broken vs fixed)
Start a01_bounty_demo.py (binds 127.0.0.1:8765). If your lab VM already serves this app at http://192.168.0.1/, set DEMO to that. Alice and Bob have invoices. Broken GET /broken/invoices/<id> returns any invoice by id. Fixed GET /fixed/invoices/<id>?user=… asserts owner. Evidence: alice→1043 broken leaks bob; fixed denies; bob→1043 fixed allows. Capture status + snippets with curl -sS -D -. No bank. No public shop. No nmap of 192.168.0.0/24.
Command guide
A01 BAC — Step 1 - Reproduce on YOUR loopback (broken vs fixed)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8765"
Command — copy this
curl -sS -m 3 -D - "$SAFE/broken/invoices/1043?user=alice" | head -n 18
curl -sS -m 3 -D - "$SAFE/fixed/invoices/1043?user=alice" | head -n 18
curl -sS -m 3 -w "bob_fixed %{http_code}
" "$SAFE/fixed/invoices/1043?user=bob"3. Step 2 — Severity lite (bounty triage language)
For this demo: Confidentiality impact = peer invoice data (P2-style money/PII flavor on a real shop would climb). Integrity/Availability = none in this toy. Attack complexity = low (guessable sequential id). Privileges required = low (any logged-in user). Write: “Horizontal IDOR — authenticated user reads another user’s object by changing id.” Do not invent CVSS 10.0 for a lab total of $19.99. Triage honesty is how you get paid later; drama is how you get closed as N/A.
4. Step 3 — Finding report draft (the artifact that ships)
Fill bounty-finding-demo-a01.txt with: Title; Asset http://192.168.0.1/ (or SAFE 127.0.0.1:8765); Weakness A01/IDOR; Scope; numbered curl steps; Evidence; Impact; Severity; Remediation (/fixed ownership); Retest. Empty files fail. Router-admin or foreign production URLs fail ethics. chmod 600.
5. Good report vs noise (what programs close)
Good: clear title, in-scope asset, minimal steps, before/after fix path, remediation. Noise: “IDOR everywhere???,” no steps, out-of-scope host, theoretical only, duplicate of known issue without new impact, DoS ideas. This demo grades the good shape. Wrong answers still teach: a classmate paste of a live SaaS IDOR “for the report” fails the course even when the writeup looks pretty.
6. Wrong vs right: live hunt homework vs scoped loopback demo
Same word “bug bounty,” opposite blast radius. Right never needs a foreign host to finish the demo.
Wrong
Enumerate invoice ids on a real shop, campus portal, or classmate API. Fetch cloud metadata. Skip scope. Paste production URLs into the report. Bind 0.0.0.0 for the dorm. Call unauthorized testing “demo credit.”
Right
Read fictional scope → prove broken vs fixed on HOST 127.0.0.1 → severity lite → lock bounty-finding-demo-a01.txt (chmod 600). Topic 20 later for full bounty path. Next: Quiz — Broken Access Control.
Run the block on a computer you own. Two terminals: server + curls. Stop the server when done. Windows: WSL/Git Bash or py; restrict NTFS ACL if chmod is missing.
Command guide
bounty_finding_demo_a01.sh — DEMO http://192.168.0.1/ + IDOR curls + report
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install nmap sudo apt install python3
macOS:
Command — copy this
brew install nmap brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cd "$HOME/cyberlium-lab"
Command — copy this
cat > a01_bounty_demo.py << 'PY'
"""Teaching IDOR: broken vs fixed. Bind loopback; curls may use DEMO URL you own."""
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse, parse_qs
HOST = "127.0.0.1" # bind only — never 0.0.0.0, never argv
PORT = 8765
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")
INVOICES = {
1042: {"owner": "alice", "total": 19.99},
1043: {"owner": "bob", "total": 42.00},
class Handler(BaseHTTPRequestHandler):
def log_message(self, fmt, *args):
print("[demo]", fmt % args)
def _send(self, code: int, body: str):
data = body.encode("utf-8")
self.send_response(code)
self.send_header("Content-Type", "text/plain; charset=utf-8")
self.send_header("Content-Length", str(len(data)))
self.end_headers()
self.wfile.write(data)
def do_GET(self):
u = urlparse(self.path)
qs = parse_qs(u.query)
user = (qs.get("user") or ["alice"])[0]
parts = [p for p in u.path.split("/") if p]
if parts[:2] == ["broken", "invoices"] and len(parts) == 3:
inv = INVOICES.get(int(parts[2]))
return self._send(200, str(inv) if inv else "missing")
if parts[:2] == ["fixed", "invoices"] and len(parts) == 3:
inv = INVOICES.get(int(parts[2]))
if not inv:
return self._send(404, "missing")
if inv["owner"] != user:
return self._send(403, "denied")
return self._send(200, str(inv))
return self._send(
200,
"Cyberlium A01 lab app. DEMO writeup: http://192.168.0.1/ "
"Routes: /broken/invoices/ID /fixed/invoices/ID?user=alice|bob",
)
print("bind", HOST, PORT)
print("demo_writeup_url http://192.168.0.1/")
print("if 192.168.0.1 is a router, curl", f"http://{HOST}:{PORT}/")
HTTPServer((HOST, PORT), Handler).serve_forever()
PYCommand — copy this
cat > a01_practical_commands.sh << 'SH' echo; echo "--- body ---"; cat /tmp/a01_broken.body; echo echo; cat /tmp/a01_deny.body; echo echo; cat /tmp/a01_allow.body; echo SH
Command — copy this
POLICY="$HOME/cyberlium-lab/demo-program-scope.txt"
{Command — copy this
REPORT="$HOME/cyberlium-lab/bounty-finding-demo-a01.txt"
{Mission: bounty-finding-demo-a01.txt (mode 600)
1) 0.0.1:8765 after starting a01_bounty_demo.py.2) Run a01_practical_commands.sh (DEMO curls for broken vs fixed); fill bounty-finding-demo-a01.txt; chmod 600. 3) Ethics: no LAN sweep, no router hydra, no cloud metadata, no foreign SaaS.
Stuck? Ask Cyberlium AI Mentor
If “bounty practice means I must IDOR a real shop” still feels true, ask for a hint — not a target list. Try: "Hint only: what belongs in a scoped finding report, which curls prove broken vs fixed on 127.0.0.1, and where bounty-finding-demo-a01.txt lives?" You still stay on loopback. No live SaaS.
You now have a bounty-student demo artifact: fictional scope, loopback IDOR proof, severity lite, and a report draft under cyberlium-lab. That is how paid work starts — policy first, evidence second, remediation third — without unauthorized hunting. Original Cyberlium — not official OWASP or platform certification. Next — Quiz — Broken Access Control. Full bounty path continues later in Topic 20.
Knowledge Check
APPLY: A classmate says this demo is useless unless you IDOR a live SaaS “like real bounty.” What does the demo require?
Multiple choice
Knowledge Check
APPLY: True or False: A good demo report can skip Steps to Reproduce if the title says “IDOR critical.”
True or False
Knowledge Check
APPLY: Which pairing matches this Bug Bounty Finding Demo?
Multiple choice