Evidence Handling and Reporting
This domain tests preservation, chain of custody, and clear reporting of findings.
Preservation
Capture evidence with context: URL, account, timestamp in UTC, request and response, and tool version. Save proxy logs as HAR files where appropriate. Hash evidence with SHA-256 and record the hash in the chain-of-custody form. For forensic images, use a write blocker and verify the image hash against the source. Keep originals unaltered and work from copies.
Reporting
A strong report has an executive summary, scope and methodology, findings ranked by risk, reproduction steps, impact, evidence, remediation, and appendices. Use CVSS vectors and state verification limits. Redact credentials and personal data. Separate confirmed findings from observations and informational items.
Worked example
An IDOR is confirmed with two accounts. Save the raw HTTP request and response, the account IDs used, and the UTC timestamp. Compute SHA-256 over the evidence file and record it. The reasoning: the hash proves the file was not altered, while the request context proves the finding is reproducible and not a scanner artifact.
Traps
Altering the original evidence. Missing hashes or chain-of-custody entries. Screenshots without URL, account, or time. Overstating impact beyond what was proven. Including live credentials or personal data in the report.