Reporting web security findings
You write up a finding with reproducible steps, evidence and an actionable fix, justify its severity with CVSS, and prepare an executive summary and a retest report.
Level 201 · 15 lessons · 13 practice labs
Lessons
Writing a finding
- Anatomy of a finding: title, impact, evidence and fix
- Reproducible steps and request–response evidence
- Screenshots and redacting secrets in evidence
- Fix advice a developer can apply
- Short task: write up an XSS finding from the lab app end to end
Severity
- Scoring severity with CVSS 4.0
- Context: business impact, likelihood and compensating controls
- Mapping a finding to CWE and OWASP classes
- Inflating and downplaying severity: common mistakes
- Short task: score and justify five findings
The report and follow-up
- The executive summary: writing for a non-technical reader
- Report structure: scope, method, findings and appendices
- The retest report: closed, partly closed, open
- Moving findings into the issue tracker
- Capstone: deliver a full assessment report and a retest note
Practice labs
- Write a good title for a finding: Rename five vaguely titled findings so each includes the flaw class, location and impact.
- Reproducible steps: Write steps someone else can repeat and the request-response evidence for an IDOR in the lab app.
- Redact secrets in evidence: Find and redact session cookies, personal data and tokens in screenshots and request evidence.
- A fix a developer can apply: Turn a generic fix recommendation into a concrete one tied to the real line and language in the lab code.
- Write a chained finding as one story: Write one finding that explains the combined impact of two linked small flaws and attach evidence for each step.
- Fill in a CVSS 4.0 vector: Fill in the CVSS 4.0 vector for a stored XSS finding and justify each metric choice in one sentence.
- Map findings to CWE and OWASP: Map six findings to the right CWE and OWASP classes and correct two that were mapped wrongly.
- Lowering severity for a compensating control: Reassess the severity of an injection finding behind a WAF in context and write what does and does not justify lowering it.
- Weed out inflated severities: Rescore the severity of five findings in a report by business impact and likelihood and justify the changes.
- An executive summary for a non-technical reader: Write a one-paragraph executive summary for the fictional Durelo Foods management from a technical findings list.
- Retest note: is it closed: Retest four findings said to be fixed in the lab and mark each closed, partly closed or open with evidence.
- From finding to issue tracker ticket: Turn three findings into tickets in the dev team's issue tracker with acceptance criteria and test steps.
- A full report: from scope to appendices: Deliver the full report with scope, method, findings and appendices for a short lab assessment, followed by a retest note.
About this course
You write up a finding with reproducible steps, evidence and an actionable fix, justify its severity with CVSS, and prepare an executive summary and a retest report.
What you will learn
- Writing a finding
- Severity
- The report and follow-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.