Document evidence and CVSS-score every finding — Offensive Security & Penetration Testing

What You'll Build

In this phase you will turn the raw evidence from your engagement into a rigorous, structured set of findings: each documented with clear reproduction, supporting evidence, and a CVSS-based severity, then prioritized by real risk. The deliverable is the analytical backbone of your report, a complete, credible findings set ready to be written up in the final project. This is where careful documentation throughout the engagement is transformed into professional, defensible, prioritized results.

Analogy🏏Cricket

🎬 Think of it like movies: Producing a film means running every department, scouting, shooting, editing, sound, then delivering one coherent final cut a distributor can actually screen, not a pile of loose reels. Just as the producer is judged by that single assembled cut, this exercise judges you by one consolidated, prioritized inventory drawn from passive discovery, active scanning, enumeration, and vulnerability triage. Just as no scene is shot without the studio's sign-off, none of this runs outside your authorized lab range. This reveals the recon sweep as delivering the final cut, not a heap of unassembled footage.

Prerequisites

The captured evidence from Lessons 32 and 33, footholds, escalations, movement, and web and network findings, with reproduction details.
CVSS scoring and context-aware prioritisation from Lesson 29, to rate severity consistently and rank by real risk.
The technical-findings structure from Lesson 28, description, severity, reproduction, evidence, remediation, for each issue.
The ethical documentation obligation from Lesson 27, complete and honest, hiding nothing, including any mistakes.
The connected-chain perspective from Lesson 31, so findings are related to the overall attack chain, not just listed in isolation.

Setup & Project Structure

Gather all evidence from the engagement and set up a structured findings workspace, one clear record per finding. Because this analytical set is the backbone of the final report, organize it rigorously so every finding is complete, evidenced, and scored. Relate each finding to the attack chain where relevant, so the connected story stays visible. Well-structured findings now make the final report writing in Lesson 35 straightforward, and ensure nothing discovered during the engagement is lost or under-supported.

Analogy🏏Cricket

💪 Think of it like fitness: Serious athletes train in a controlled gym they are cleared to use and keep a meticulous logbook, dating every set and weight so progress is reproducible and any coach can pick up exactly where they left off. Just as that controlled environment and dated logbook make training safe and auditable, working inside an authorized lab and saving each phase's output in dated, named files makes the recon sweep safe and reproducible. Just as an undocumented workout teaches nothing repeatable, an undocumented sweep produces findings no teammate can trust. This reveals disciplined setup as the training log that makes every result traceable.

bash

# Structure the findings set (the report's analytical backbone).
cd capstone && mkdir -p findings

# One structured record per finding.
cat > findings/TEMPLATE.md <<'EOF'
## Finding: <title>
- Severity (CVSS): <score> (<Critical/High/Medium/Low>)
- Impact: <business + technical impact>
- Reproduction: <clear, ordered steps>
- Evidence: <reference to captured proof>
- Remediation: <specific, actionable fix>
- Chain link: <where this fits in the attack chain, if applicable>
EOF
cat findings/TEMPLATE.md

Step 1 — Document Each Finding with Evidence

Work through every discovery from the engagement, creating a complete record for each: the vulnerability, its impact, clear reproduction steps, and the supporting evidence you captured. Precision and reproducibility are essential, a finding an engineer cannot reproduce cannot be verified or trusted. Draw on your timestamped documentation to make each record accurate and complete. Include every genuine finding honestly, per your ethical obligation, so the set faithfully represents everything the engagement uncovered.

Analogy🏏Cricket

🎵 Think of it like music: A faithful transcription writes down every note exactly as played, pitch, timing, and dynamics, so another musician can reproduce the performance precisely and nothing is left ambiguous. Just as an unreproducible transcription is worthless to the player reading it, a finding an engineer cannot reproduce is worthless to the team fixing it. Just as an honest transcriber omits no note, even an awkward one, an honest tester omits no genuine finding. This reveals why each record must be precise, reproducible, and complete: the score the fixers will play from.

bash

# Document each finding completely, from captured evidence.
#   for every discovery -> fill the TEMPLATE: description, impact,
#   reproduction, evidence reference, remediation

# Precision + reproducibility: an engineer must be able to reproduce it.
# Honesty: include EVERY genuine finding (Lesson 27 obligation).
echo One complete, evidenced record per finding in findings/

Step 2 — Assign CVSS Severity

For each documented finding, assign a CVSS-based severity, reasoning from the factors, how it is accessed, exploitation complexity, privileges needed, and impact, so scores are consistent and defensible. Record the score with each finding. Consistent scoring gives every finding a comparable baseline severity and a common language the client will understand. This baseline is the input to prioritisation, but remember from Lesson 29 that the score is a starting point, not yet the final order of fixes.

Analogy🏏Cricket

📷 Think of it like photography: Exposure is judged on a fixed, shared scale, the stops of the light meter, so every frame's brightness is measured the same defensible way rather than by gut feeling. Just as that consistent scale lets photographers compare shots fairly regardless of who took them, CVSS lets you compare findings fairly by reasoning from access, complexity, privileges, and impact. Just as the meter reading is a baseline before you make an artistic choice, the CVSS score is a baseline before business-context prioritisation. This reveals why consistent scoring gives every finding a common, comparable language.

bash

# Assign a consistent CVSS-based severity to each finding.
#   reason from factors: access, complexity, privileges/interaction,
#   impact on confidentiality / integrity / availability
#     9.0-10.0 Critical | 7.0-8.9 High | 4.0-6.9 Medium | 0.1-3.9 Low

# Record the score in each finding. This is the BASELINE severity,
# not yet the final fix order (see Step 3).
echo Every finding now carries a consistent CVSS severity

Step 3 — Prioritize by Real Risk

Turn scores into a prioritized remediation order using CVSS plus business context, exactly as Lesson 29 taught. Weigh each finding's exposure, affected-asset value, and real exploitability, and factor in the attack chain, a finding that forms a critical link may deserve elevated priority. Produce a clear, ranked list of what to fix first and why. This context-aware, chain-aware prioritisation is what will make the final report genuinely actionable for the client.

Analogy🏏Cricket

✈️ Think of it like travel: Planning a trip, you do not visit sights in order of their star rating alone, you weigh which are truly reachable, which fit your limited days, and which unlock the rest of the itinerary, then rank the real stops. Just as raw ratings give way to a route shaped by real value and access, raw CVSS gives way to a fix order shaped by exposure, asset value, and exploitability. Just as a stop that connects onward earns priority, a finding that forms a key chain link earns elevated priority. This reveals why prioritisation is context-aware and chain-aware, not score alone.

bash

# Prioritize by real risk: CVSS + business + chain context.
cat > findings/priorities.md <<'EOF'
## Remediation Priorities (real-risk order)
1. <finding> — CVSS <n> + exposed/critical + KEY CHAIN LINK -> fix FIRST
2. <finding> — CVSS <n> + moderate exposure -> next
3. <finding> — CVSS <n> + isolated/low value -> later

Note: order reflects real risk AND chain impact, not raw score alone.
Breaking a key chain link can neutralize the whole attack path.
EOF
cat findings/priorities.md

Step 4 — Quality-Check the Findings Set

Finish by reviewing the whole findings set for quality and honesty before it feeds the report. Confirm every finding is reproducible, evidenced, and consistently scored, that none is inflated or omitted, and that each is related to the attack chain where relevant. Tag each finding as systemic or isolated to guide durable fixes. This quality check ensures the analytical backbone you hand to Lesson 35 is complete, credible, and faithful to everything the engagement actually uncovered.

Analogy🏏Cricket

💰 Think of it like finance: Before signing off, an auditor reviews the whole ledger for integrity, every entry supported, every figure consistent, nothing inflated for effect and nothing quietly omitted, and flags which issues are systemic patterns versus one-off errors. Just as that review makes the accounts trustworthy and actionable, your quality check makes the findings set credible and complete. Just as tagging systemic versus isolated guides lasting financial fixes, tagging each finding the same way guides durable security fixes. This reveals why a rigorous, honest review is what lets the client trust and act on the analysis.

bash

# Quality-check the findings set before it feeds the report.
cat > findings/qa_check.md <<'EOF'
# Findings QA Checklist
  [ ] every finding reproducible + evidenced
  [ ] CVSS scores consistent and defensible
  [ ] nothing inflated; nothing omitted (Lesson 27)
  [ ] each finding related to the attack chain where relevant
  [ ] each tagged systemic vs isolated (guides durable fixes)
EOF
cat findings/qa_check.md

Warning: Uphold the ethical obligation from Lesson 27 throughout this phase: document every genuine finding honestly and completely, including anything inconvenient or any mistakes made during testing. Do not inflate severities for effect or omit findings for convenience, both distort the client's understanding of real risk. Keep scoring consistent and defensible, and let context, not exaggeration, drive prioritisation, so the client can trust and act on the analysis you deliver.

Extension Challenge: Strengthen the analysis three ways. First, add a one-line note to each finding on whether it is systemic (recurring pattern) or isolated, guiding durable fixes. Second, explicitly identify which single finding, if fixed, would break the most of your attack chain, and elevate it in priority. Third, for the top few findings, draft the plain-language business-impact sentence you will reuse in the executive summary, getting a head start on Lesson 35.

This phase transforms raw engagement evidence into a rigorous findings set, each with reproduction, evidence, and CVSS severity, prioritized by real risk.
Every finding is documented completely and honestly with precise, reproducible steps and supporting evidence, per the ethical obligation from Lesson 27.
Each finding receives a consistent, defensible CVSS-based severity reasoned from its access, complexity, privileges, and impact factors.
Prioritisation combines CVSS with business context and attack-chain impact, so a critical chain link can warrant elevated priority over a higher raw score.
Relating findings to the attack chain keeps the connected story visible and highlights where breaking one link neutralizes an entire path.
The structured, evidenced, prioritized findings set is the analytical backbone that makes writing the final report straightforward and credible.