OSC: Reporting and Documentation

Reporting and Documentation is a scored domain, not an afterthought. Examiners read the report to decide whether you demonstrated the compromise and whether a client could reproduce it. Every command, output and screenshot you did not save is a finding you cannot claim.

Core rules

• Take timestamped notes as you go, in one place: target, command, output, result. Never rely on memory or scrollback.
• Capture evidence per finding: the command, the output showing uid=0 or SYSTEM, the file path, the hash, the proof file.
• Structure each finding as title, affected host, severity, description, reproduction steps, evidence, remediation.
• Reproduction steps must be exact enough for a third party: URL, payload, credential, and tool version.
• Separate the executive summary, covering business impact, risk and scope, from the technical detail.
• Note unsuccessful avenues briefly; they show coverage and justify stated limitations.

Worked example

A privilege escalation finding reads: Local privilege escalation via misconfigured sudo, High, host 10.10.10.5, user www-data. sudo -l returned (root) NOPASSWD: /usr/bin/find. Running sudo find . -exec /bin/sh \; -quit returned a root shell, and the id output is captured as evidence. Remediation: remove the sudo entry or restrict it to a fixed argument set. Reasoning: it names the vector, proves it, and gives a sysadmin an actionable fix.

Traps that cost marks

Screenshots without the command that produced them; remediation that only says patch the system; omitting proof of root or SYSTEM; submitting raw notes instead of a structured report; and including stale or out-of-scope hosts.