Writing the report — start of Lab 3

You no longer attack. You deliver. Lab 3 starts here and is submitted in week 14: a 20-to-30-page PDF, six findings minimum, a plan at 3, 6 and 12 months. This lesson gives you the simulated engagement, the skeleton to fill in, and the rubric the grader will use — use it before you send.

Count on it. 8 to 12 hours of writing, spread over two weeks. The first session (today) locks the outline, the six titles and the priorities. The second writes. The third reads the summary out loud.

Deliverable. rapport-nordik-commerce.pdf, 20 to 30 pages, plus an preuves/ folder named according to Cxx-YYYY-MM-DD-….

No new attack

The simulated engagement below and your lab notes are enough. You send no packet to a third-party target. You do not open a scope "to enrich the report." Writing a made-up P1, or re-exploiting outside the lab, is a zero — and, outside the lab, a crime.

What you will be able to do after this lab

• Assemble a report read by management and by the technical team.
• Settle six coherent priorities (2 P1, 2 P2, 2 P3 or more) from raw notes.
• Fill in the finding template without missing a field.
• Propose a credible remediation plan at three horizons.
• Grade yourself with the Lab 3 rubric before submission.

---

1. What you need

• Lessons 12.1 and 12.2 read. The C-01 sheet from the walkthrough is the standard, not a finding to copy verbatim (unless you make it one of the six, adapting it to the Nordik client).
• Your notes from modules 3 to 11, if you want to anchor a piece of evidence in a lab you actually ran (Juice Shop 10.10.10.50:3000, DVWA, the AD from modules 9-10).
• A word processor or Markdown → PDF (Pandoc, Typora, Word, LibreOffice). Readable font, numbered headings, table of contents.
• The notebook from section 3. That is the material of the simulated engagement.

---

2. Simulated engagement — Nordik Commerce inc.

You write as if you had run the engagement. The facts below are deemed true. You add no others, except evidence from your lab and clearly labeled "lab illustration, same class of flaw."

Client        : Nordik Commerce inc. (online store, Montreal)
Sponsor       : IT Management, Marie Tremblay
Type          : grey-box, application + identity perimeter
Dates         : 14-18 April 2026, 09:00-18:00 America/Toronto
In scope      : shop.nordik.example (lab: 10.10.10.50:3000)
                vpn.nordik.example (port 443)
                mail (Google Workspace, domain nordik.example)
Out of scope  : Stripe provider, Atlassian Cloud, DoS, phishing
Accounts      : one customer account `acheteur@nordik.example`
Extraction    : at most 5 rows per table, no real PII outside the lab
Method        : OWASP Testing Guide v4.2 + identity controls (M05, M06)

2.1. Engagement notebook — eight raw notes

You must produce six findings. The notebook contains eight. Two notes are traps: too weak, duplicate, or out of scope. Discard them or downgrade them to P4 in the overview, without turning one into a filler P1.

Note A — Catalog search

shop GET /rest/products/search?q=
q=apple' -> 500 SQLITE_ERROR
UNION -> table Users  (3 rows, RoE)
admin@juice-sh.op  hash MD5 0192023a7bbd73250516f069df18b500 -> admin123
see walkthrough 12.2  /  module 7 step 3

Note B — Direct object (IDOR)

GET /rest/basket/1  with the cookie of acheteur@...
GET /rest/basket/2  same cookie -> 200, another customer's basket
order lines, email, address
module 7, A01

Note C — Stored XSS, product review

product comment: <img src=x onerror="…">
the admin who opens Moderation runs the JS
admin session cookie visible (HttpOnly missing on the lab cookie)
module 7 step 4

Note D — DMARC policy

_dmarc.nordik.example  TXT  v=DMARC1; p=none; rua=mailto:dmarc@nordik.example
SPF present  include:_spf.google.com
phishing not authorized by the RoE: we did NOT send any email
module 3 / module 6

Note E — Listing /assets/backups

GET /assets/backups/  -> 200  index of
dump-2023-11.sql  (we did NOT download, RoE extraction)
last-modified 2023-11-02

Note F — Server banner

Server: nginx/1.18.0
X-Powered-By: Express
no exploit launched

Note G — VPN: certificate and portal

vpn.nordik.example  TLS 1.2 OK
Forti-like portal,  no MFA on the provided test account
password spraying NOT done (outside the window)
test account `vpn-invite` / `Nordik2024!`  still valid on 18 April

Note H — Jira ticket cited in an HTML comment

<!-- fix NORDIK-1842 see jira.nordik.example -->
jira.nordik.example  -> Atlassian Cloud  OUT OF SCOPE
we did not authenticate

2.2. What the grader expects as a breakdown

Priority	Quota	Notes that can go there	Notes that do not go there
P1	2	A (admin SQLi), B (basket IDOR) or C if admin session theft is demonstrated	F, H
P2	2	C (if not already P1), G (weak VPN account without MFA), possibly E if the dump is argued	F
P3+	2	D (DMARC p=none without real phishing), E (listing), G if you already have two stronger P2	A downgraded "because it's a lab"

Note F is not a P2 finding. It can appear as P4 or in the overview ("exposed versions"). Note H is not an Atlassian intrusion finding: out of scope. You mention it as a boundary: report to the client, no test.

You may replace a note with an equivalent finding drawn from your lab (EternalBlue from module 5, Kerberoast from module 9) provided you keep the 2 / 2 / 2 breakdown and the template.

---

3. Page budget — aim for 24, not 19 or 41

Part	Pages	What makes it slip
Cover page + distribution	1	Logos, NDA notices
Executive summary	1-2	Jargon, day-by-day history
Scope and method	2	Copy-paste of the entire RoE in the body
Overview	2	Six-page attack novel
Six findings	10-14	Full JSON in every sheet
Recommendations 3 / 6 / 12 months	2-3	Repeating the sheets word for word
Appendices	3-6	40-page Nmap export

Fewer than 20 pages: a sheet, the evidence, or the plan is missing. More than 30: you pasted tools. Cut the appendices, not the P1 justifications.

---

4. Report skeleton — copy then fill in

The outer frame uses four backticks: the skeleton itself contains evidence blocks. Copy it into ~/mission/rapport-nordik.md, then export to PDF.

# Penetration test report
## Nordik Commerce inc. — store `shop.nordik.example`

| Field | Value |
| --- | --- |
| Reference | NORDIK-PT-2026-04 |
| Classification | Confidential — limited distribution |
| Version | 1.0 |
| Test dates | 14-18 April 2026 |
| Report date | 22 April 2026 |
| Author | `your-name` |
| Recipient | Marie Tremblay, IT Management |

Distribution list: sponsor, CISO, application owner.
No transfer outside the NDA.

---

## 1. Executive summary

*(Write LAST. 1 to 2 pages. Conclusion in the first sentence.)*

**Posture.** `insufficient | acceptable with reservations | under control` —
`one sentence that cites the number of P1`.

**Scope in one sentence.** Grey-box, store and VPN portal, excluding Stripe
and Atlassian, excluding denial of service and phishing.

**Count.**

| P1 | P2 | P3 | P4 |
| --- | --- | --- | --- |
| 2 | 2 | 2 | `n` |

**Three risks management can repeat.**

1. `business sentence` (C-0x)
2. `business sentence` (C-0x)
3. `business sentence` (C-0x)

**Decisions for the week.**

1. `rotation, closure, taking offline`
2. `…`
3. `…`

No tool, no CVE, no screenshot here.

---

## 2. Scope and methodology

### 2.1. Included / excluded

| Included | Excluded |
| --- | --- |
| `shop.nordik.example` (lab 10.10.10.50:3000) | Stripe, Jira Cloud |
| `vpn.nordik.example` | DoS, active phishing |
| Provided customer account | Subsidiaries, wifi, physical |

### 2.2. Rules of Engagement

Windows 09:00-18:00 America/Toronto. Extraction <= 5 rows.
No modification of real commands. Escalation: Marie Tremblay.

### 2.3. Method and tools

OWASP Testing Guide v4.2. Burp Suite (Repeater), `curl`, `sqlmap`
(confirmation, `--stop=3`), `dig` (DMARC). Each tool has a role;
no raw export is a finding.

### 2.4. Limits

`what was not tested: admin API without account, phishing, Atlassian.`
These limits **reduce** confidence: the absence of a P1 elsewhere
is not a security attestation.

---

## 3. Overview

### 3.1. Heat map

| Theme | P1 | P2 | P3 | P4 |
| --- | --- | --- | --- | --- |
| Application | `n` | `n` | `n` | `n` |
| Identity | `n` | `n` | `n` | `n` |
| Network / VPN | `n` | `n` | `n` | `n` |
| Mail | `n` | `n` | `n` | `n` |

### 3.2. Posture indicator

`One sentence. E.g.: insufficient — two P1 from the Internet without privilege.`

### 3.3. Attack path (one paragraph)

Link the sheets: public search -> admin account -> session;
or IDOR basket -> a third party's data. Do not invent an AD pivot
if you do not have the notes.

---

## 4. Detailed findings

Each sheet: title, severity (P + CVSS + justification), context,
evidence, business impact, remediation (action, test, effort), references.

### C-01 — `title action + surface`

**Severity.** P`x`. CVSS 3.1: `score` — `vector`.
Business justification: `one sentence`.

**Context.** `one functional sentence`.

**Evidence.** Date, target, extraction limit.

```bash
curl -sS -G 'http://10.10.10.50:3000/rest/products/search' \
  --data-urlencode "q=…"
```

```http
HTTP/1.1 200 OK
Content-Type: application/json
```

Screenshot: `C01-2026-04-16-….png` (appendix A).

**Business impact.** `already demonstrated, not a scenario`.

**Remediation.**
1. Immediate:
2. Fix:
3. Compensation:
4. Closure test: `the same evidence, a different expected result`.
Effort: `person-days, role`.

**References.** CWE-…, OWASP …, CVE if one exists.

### C-02 — `…`

*(same template)*

### C-03 — `…`

### C-04 — `…`

### C-05 — `…`

### C-06 — `…`

---

## 5. Prioritized recommendations

Group by theme, not by sheet number. One action can close
two findings (all SQL queries parameterized = C-01 and any
injectable login).

### 5.1. Identity
### 5.2. Application
### 5.3. Network and VPN
### 5.4. Mail

### 5.5. Three-horizon plan

| Horizon | Objective | Actions (finding refs) | Effort | Suggested owner |
| --- | --- | --- | --- | --- |
| 0-3 months | Cut the exposure | P1 + rotations + VPN MFA | `p/d` | Dev + Ops + IdM |
| 3-6 months | Harden the business | IDOR, XSS, access reviews | `p/d` | Dev + CISO |
| 6-12 months | Hold the line | Security CI, DMARC reject, inventory | `p/d` | CISO + DevOps |

Narrative detail: one paragraph per horizon — what changes for the
client if they do not do it, not an OWASP lecture.

---

## 6. Appendices

### A. Evidence per finding
Index of files `Cxx-YYYY-MM-DD-*`.

### B. Full requests
Burp / `curl` `-D` files.

### C. Tool logs
`sqlmap` limited, `dig` DMARC. No full scan.

### D. Screenshots
Visible timestamp. Personal areas masked.

---

5. How to fill in without copying the walkthrough

The C-01 sheet from lesson 12.2 is a quality model. If you keep note A, you rewrite it for Nordik: the title can become SQL injection on the catalog search, the summary talks about Nordik Commerce, not Juice Shop. The lab commands stay 10.10.10.50:3000: you say so in the scope (reproduction environment).

For note B (IDOR), the minimal evidence looks like this — adapt it to your lab cookie, never a production cookie:

# two baskets, a single account
curl -sS -H "Cookie: token=YOUR_LAB_TOKEN" \
  http://10.10.10.50:3000/rest/basket/1 | jq '{id,UserId}'
curl -sS -H "Cookie: token=YOUR_LAB_TOKEN" \
  http://10.10.10.50:3000/rest/basket/2 | jq '{id,UserId}'

Teaching goal: the second call returns a UserId that is not yours. Impact: reading someone else's orders. Likely priority: P1 if a third party's data with no obstacle, P2 if the lab only returns totals.

For note D, you did not send a mail. The impact reads: the policy does not stop a third party from sending a message in the domain's name; no send was performed (out of RoE). This is not a P1.

For note G, the demonstration password is masked in the body (Nord***!) and put in an appendix.

---

6. 3 / 6 / 12-month plan — what is credible

A plan is not the remediation list copied three times. Each horizon has an intent.

0 to 3 months — stop the bleeding. Everything that is P1, plus the compensations that reduce the surface while the fix lands. Rotation of exposed secrets. MFA on the VPN. Closure of the /assets/backups listing or removal of the file. A weekly committee until the P1 are closed. Typical effort for a shop this size: 15 to 30 person-days, mostly application development.

3 to 6 months — fix the business. Systematic access control on resources with an identifier (no more one IDOR at a time). Output encoding on all reviews. Review of invitation accounts. Move DMARC to quarantine (not reject yet if legitimate flows are not aligned). Closure tests replayed by someone other than the author of the fix.

6 to 12 months — make it hold. DMARC reject once SPF/DKIM are clean. CI pipeline: injection test and IDOR test on new endpoints. Inventory of portals (VPN, admin, old backups). A dry-run Law 25 notification exercise. The P4 (nginx banner) is handled here, not in week 1.

A horizon without an owner does not exist

"The team" is not an owner. Put a role: application owner, ops, identity, CISO. The client will fix the name; they cannot fix an empty line.

---

7. Self-assessment rubric — 100 points, identical to Lab 3

Check before the PDF export. Each unchecked box is a return to writing, not a mental note.

7.1. Executive summary — 15 points

• The first sentence gives the posture and the number of P1.
• A director understands without a glossary.
• Three business risks, each linked to a C-0x.
• Decisions for the week, not a list of tools.
• The summary stands without reading the findings.

7.2. Six findings on the template — 30 points

• Six sheets minimum, seven fields each (title, severity, context, evidence, impact, remediation, references).
• Titles = action + surface, usable as a ticket.
• One replayable piece of evidence (curl or HTTP) per sheet, dated.
• One testable remediation per sheet (the closure test is written).
• No finding = pasted tool export.
• Secrets masked in the body, complete only in the appendix.

7.3. Breakdown and coherence — 10 points

• At least 2 P1, 2 P2, 2 P3 or more.
• No note F or H promoted to P1/P2.
• Each CVSS -> priority gap is justified in one sentence.
• Two surfaces = two sheets (not one "global SQLi").

7.4. Three-horizon remediation plan — 20 points

• 3 / 6 / 12-month table filled in (actions, effort, owner).
• The P1 live in the 3 months, not at 12 months.
• At least one structural action (SQL parameterization everywhere, generic access control).
• One paragraph per horizon, consequences if deferred.

7.5. Evidence in appendices — 10 points

• Index Cxx-YYYY-MM-DD-….
• Timestamped screenshots, masked areas.
• No 40-page Nmap.
• Extraction RoE visible (e.g. --stop=3).

7.6. Defensible prioritization — 10 points

• You can say each P1 out loud in fifteen seconds.
• No movie threat ("a group is going to…").
• The scope limits appear (what was not tested).

7.7. Clarity and presentation — 5 points

• 20 to 30 pages.
• Table of contents, stable sheet numbers.
• One voice, complete English, no "!!!".
• Cover page, classification, distribution list.

Submission threshold. 80 / 100 on the self-assessment, otherwise you do not export. The grader uses the same rubric.

---

8. Three sessions, then submission

1. Arbitration (2 h). Six titles, six priorities. If the P1 are "nginx" and "Jira comment," start over.
2. Writing (5 h). Order: findings -> overview -> plan -> scope -> summary. Appendices at the same time as each sheet.
3. Proofreading (2 h). Summary read to someone outside the course. P1 justifications timed. PDF 20-30 pages.

Traps. An 18-page PDF with no sheets; six P1 to "look serious"; summary written first; screenshot without curl; a plan that repeats "fix the vulnerabilities"; notes from a real bug bounty.

PDF export

pandoc rapport-nordik.md -o rapport-nordik-commerce.pdf --toc. A curl line cut in the middle of a quote becomes false evidence.

[ ] PDF 20-30 pages, filename rapport-nordik-commerce.pdf
[ ] preuves/ folder (one file per finding)
[ ] Self-assessment >= 80
[ ] No target outside the lab / outside the simulated engagement
[ ] No secret in cleartext in the submission email

The Lab 3 in week 14 grades this deliverable. What you start today is already the object of the grade.

---

What you take away from this lab

A skeleton you will reuse on a real engagement — the six parts do not change, only the facts change. A discipline of priority: two defensible P1, not a siren. A plan someone can hold for a year. The grader's rubric, used early enough that the PDF is not a surprise. The report is the product; you just built it.