Hands-On Bug Hunting for Penetration Testers

Gathering Report Information

Now that we've brought our company to its knees, let's walk through the info we need to write our report:

• Category: This is a data leak of sensitive information. In this case, the CEO's salary and SSN.
• Timestamps: For our timestamp, we can just approximate a time manually.
• URL: For our URL, we can use the page where we discovered the info in the source code:

http://localhost:8081/WebGoat/start.mvc#lesson/ClientSideFiltering.lesson/1

• Methodology: Skipping payload, we can just head to the methodology. In this case, we simply came across the information after a close inspection of the page's source code.
• Instructions to reproduce: Simple enough. Navigate to the affected page and look at its source.
• Attack scenario ...