Exploit › Module 9 › Lesson 1
Write Findings
Write memory-safety findings from $PWN_LAB — structured report rows, observed vs inferred, no exploit proof attachments.
Visual · t24_write_findings
Write findings = defender report literacy. $PWN_LAB sourced. Original Cyberlium.
Opening
A finding says what broke, how you know, and what to fix — not how you popped a shell.
Memory-safety finding writeup structure: title, affected component (YOUR toy version/hash), bug class, reproduction steps (observe-only from Module 6), impact literacy without exploit demonstration, evidence references (GDB snapshot, checksec, sanitizer log), recommendation preview. Use clear observed vs inferred labels. Cyberlium teaches findings from $PWN_LAB toys and authorized brief targets — NOT findings from unauthorized prod testing, NOT attach exploit PoC or shellcode as 'proof of severity,' NOT publish stranger host details. chmod 600 draft under $HOME/cyberlium-lab/reports. Feeds capstone evidence pack.
1. Finding sections
Summary, affected asset, bug class, repro (observe), impact literacy, evidence list, recommendation stub.
Severity: use learning scale + 'would be Critical if deployed as prod service without fix.'
Command guide
Try these commands — Finding sections
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CWE reporting — https://cwe.mitre.org/ (weakness ID in findings) NVD — https://nvd.nist.gov/ (severity/context literacy) Microsoft SDL — https://learn.microsoft.com/en-us/security/sdl/ (defender report structure)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
cat > "$LAB_PWN/notes/findings-template.txt" <<'EOF'
finding: stack buffer overflow in YOUR bof_vuln.c (gets)
CWE: CWE-121 / CWE-120
evidence: gdb bt + minimal crash input + checksec before/after
impact: crash on YOUR toy — remediate with fgets + hardening flags
never attach: ROP chains, shellcode, exploit scripts
EOFCommand — copy this
grep -E 'finding|CWE|evidence|never' "$LAB_PWN/notes/findings-template.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: CWE reporting (https://cwe.mitre.org/); NVD (https://nvd.nist.gov/); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Redact paths tokens; include hashes not live stranger binaries.
GDB bt excerpt OK; ROP chain not OK.
3. Scope
$PWN_LAB toys and authorized lab only — integrity block required.
Refused: dramatized exploit video as severity proof.
4. What you ship: finding writeup outline
Section list + observed/inferred rule + evidence allow/refuse lists.
5. What you record before the next lesson
Finding writeup outline path.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Finding includes pwntools exploit appendix on classmate's app.
Right
Finding writeup outline for $PWN_LAB work. Next: Remediation First.
Mission: finding writeup outline
1) List finding sections in order. 2) Write observed vs inferred rule. 3) Draft finding from Module 6 crash lab. 4) Evidence refuse list.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Impact without exploit demo?”
Knowledge Check
APPLY: Finding writeup on Cyberlium includes:
Multiple choice
Knowledge Check
APPLY: True or False: Exploit video required for severity.
True or False
Knowledge Check
APPLY: Evidence should:
Multiple choice