Platforms

HackerOne, Bugcrowd, and similar platforms host programs — literacy on where YOUR $SCOPE_HOST policy lives.

15 min+40 XP3 quiz

Module progress1 of 5

Visual · bounty_platforms

Platform literacy. HackerOne/Bugcrowd named. $SCOPE_HOST only. Original Cyberlium.

Opening

Platforms are marketplaces for authorized research — not catalogs of random targets.

Bug bounty platforms like HackerOne and Bugcrowd connect researchers with organizations publishing vulnerability disclosure and bounty programs. Each program page lists scope, rules, safe harbor, and submission workflow. Enrollment means you accept those terms for that specific program — not every program on the platform. Cyberlium teaches platform literacy so you find YOUR enrolled program at $SCOPE_HOST. You will NOT browse public programs and test unlisted assets, or treat platform membership as permission to scan strangers. Next: Program Types.

1. What platforms provide

Platforms host program pages, scope documents, submission forms, triage communication, and payment rails. Researchers filter by technology, bounty range, and scope size — then enroll before testing.

HackerOne and Bugcrowd are named here for literacy only. Your obligation is to the specific program YOU joined listing $SCOPE_HOST — not the platform brand in general.

Command guide

Try these commands — What platforms provide

═══ LINUX / macOS (Web & API Security Testing) ═══

Test HTTP methods on authorized lab endpoint

Command — copy this

for method in GET POST PUT DELETE OPTIONS; do
  curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
done

Test JSON API with Authorization Bearer header

Command — copy this

curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <TEST_TOKEN>" \
  -d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || cat

Check for CORS misconfiguration headers

Command — copy this

curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"

Primary tools to practice this lesson: curl, jq. Reference sites: HackerOne programs (https://hackerone.com/directory/programs); Bugcrowd programs (https://bugcrowd.com/engagements). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Enrollment is per program

Accepting one program's rules does not authorize another. Each program has its own scope, rate limits, and safe harbor. Bookmark the exact URL for $SCOPE_HOST and re-read before sessions.

Platform reputation scores reward rule-followers. Scope violations can ban accounts — not a badge of honor.

3. Platforms are not target lists

Browsing 'new programs' for recon ideas on unenrolled assets is misuse. Pick programs deliberately, enroll, read scope — then test $SCOPE_HOST only.

Ship: platform name + program URL placeholder for YOUR $SCOPE_HOST enrollment. Next: Program Types.

4. What you ship: platform + program enrollment note

Name platform (HackerOne/Bugcrowd/etc.). Program URL for $SCOPE_HOST. NEVER unenrolled targets. chmod 600.

5. What you record before the next lesson

Date. Platform name. $SCOPE_HOST program URL note. File t20-m02-l01-platforms.txt chmod 600.

6. Wrong vs right: random sites vs in-scope program

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong
Scan every program on HackerOne 'for practice.' Test assets before clicking Accept.
Right
Document platform and YOUR $SCOPE_HOST enrollment. Next: Program Types.

Mission: document YOUR platform enrollment

1) Name the platform hosting YOUR program. 2) Write placeholder URL for $SCOPE_HOST program you joined. 3) Note enrollment date. 4) chmod 600. Never test before enrolling.

Stuck? Ask Cyberlium AI Mentor

Enrollment click is your contract — read before you accept.

Knowledge Check

APPLY: HackerOne/Bugcrowd platforms host:

Multiple choice

Knowledge Check

APPLY: True or False: Joining one program authorizes testing all programs on that platform.

True or False

Knowledge Check

APPLY: Before testing $SCOPE_HOST on a platform you should:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP