Lab — Validate

Run validation hygiene on $LAB_BOUNTY or enrolled scope — minimal proof, no harm, dup check, pre-submit pack.

25 min+39 XP3 quiz

Module progress4 of 5

Visual · t20_validate_lab

Lab: validation hygiene workflow on scope. Original Cyberlium.

Opening

Practice the full validation pipeline on an asset you are allowed to touch — not on production strangers.

On $LAB_BOUNTY or one enrolled $PROGRAM asset per brief: (1) pick one bug-class hypothesis from Module 6; (2) validate with minimal proof — redacted HTTP, stop after first foreign object or one XSS marker; (3) complete no-data-harm checklist — document data touched (synthetic only); (4) run dup/noise check — search platform dupes or mark lab N/A; (5) draft pre-submit validation summary (not full public report yet). chmod 600 in $HOME/cyberlium-lab. No destructive tests, no mass scans, no submissions on unenrolled targets. If validation would harm real users, stop at literacy paragraph and describe impact in words.

1. Validation pipeline

Scope verify → minimal repro → harm check → dup search → pre-submit summary.

Each step gets one checkbox row in notes with UTC timestamp.

Command guide

Try these commands — Validation pipeline

═══ LINUX / macOS (Web & API Security Testing) ═══

Test HTTP methods on authorized lab endpoint

Command — copy this

for method in GET POST PUT DELETE OPTIONS; do
  curl -s -o /dev/null -w "%-8s -> Status: %{http_code}
" -X $method "http://${LAB_HOST:-127.0.0.1}/api/v1/user"
done

Test JSON API with Authorization Bearer header

Command — copy this

curl -s -X POST "http://${LAB_HOST:-127.0.0.1}/api/v1/profile" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <TEST_TOKEN>" \
  -d '{"id": 1, "action": "view"}' | jq . 2>/dev/null || cat

Check for CORS misconfiguration headers

Command — copy this

curl -s -I -H "Origin: https://attacker.com" "http://${LAB_HOST:-127.0.0.1}/api/v1/status" | grep -i "Access-Control"

Primary tools to practice this lesson: curl, jq. Reference sites: Proof lab; HackerOne report guide (https://docs.hackerone.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Evidence hygiene

Redact tokens, emails, phone numbers — use testuser+lab@yourdomain if program allows.

Store proof attachments local chmod 600 — not public paste bins with live cookies.

3. Stop and escalate

If dup found, document root cause comparison — do not re-submit same bug.

If OOS, move hypothesis to backlog for different program — do not test anyway.

4. What you ship: validation lab pack

Pipeline checklist completed + minimal proof redacted + dup/noise result + data-touched line.

5. What you record before the next lesson

Validate lab pack path.

6. Wrong vs right: random sites vs in-scope program

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong
Validate IDOR by exporting entire user table on unenrolled API.
Right
Validation lab pack on scope or $LAB_BOUNTY. Next: quiz.

Mission: validate lab

1) Run full validation pipeline on one bug. 2) Attach minimal redacted proof. 3) Dup/noise check documented. 4) Secure notes chmod 600.

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “When to stop at impact description only?”

Knowledge Check

APPLY: Validate lab uses:

Multiple choice

Knowledge Check

APPLY: True or False: Skip dup search to submit faster.

True or False

Knowledge Check

APPLY: Validation pack includes:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP