Write up a finding
Write a short penetration-test report to report.md in your home for one vulnerability you found earlier in this course. Include a clear Severity and a Remediation for it (the other sections — impact, steps, evidence — make it a complete finding).
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
A finding that states severity, impact, exact reproduction steps, evidence and a concrete remediation is one an engineer can act on without you in the room — and that's the whole point of the engagement. Score consistently with CVSS, prioritise by risk and effort, and retest to prove each hole is actually closed.
Show solution
cd /home/student
cat > report.md <<'EOF'
# Web Application Penetration Test - Summary Report
## Executive summary
One Critical issue allows full authentication bypass and database access.
## Finding 1: SQL injection in /app/login
Severity: Critical (CVSS 9.8)
Impact: An attacker bypasses login and reads the entire user database.
Steps to reproduce: POST username=admin'-- and any password to /app/login.
Evidence: Response returned the admin secret vulntech{sql1_auth_bypass_with_comments}.
Remediation: Use parameterised queries; never concatenate input into SQL. Add generic
error messages and least-privilege database accounts.
Retest: Confirm the payload no longer authenticates after the fix.
EOF
cat report.md