Mobile › Module 9 › Lesson 1
Finding Draft
Mobile finding draft literacy — title, observed evidence, MASVS-ID, impact — on $MOB_LAB review notes.
Visual · t27_finding_draft
Finding draft = structured mobile report row. $MOB_LAB. Original Cyberlium.
Opening
A finding without observed evidence is noise — draft rows the way defenders and devs can actually retest.
Finding draft literacy for mobile: Finding ID, title, affected component (Android/iOS, version), MASVS/MASTG reference, observed evidence (file path, log line, screenshot hash), inference separate, impact category, affected data class, reproduction summary on $MOB_LAB only, recommended fix stub. No stranger-app drama titles, no exploit video against unauthorized targets. Cyberlium templates chmod 600 — professional tone for mentor handoff. Refused: copying internet CVE writeups without lab evidence, findings on prod apps without scope, sensationalized 'hacked neighbor' narratives. Lab row: one complete finding draft from Module 7 MASVS lab artifact.
1. Finding row fields
ID, title, platform, MASVS-ID, observed, inferred, impact, data class, repro summary, fix stub — ten fields.
Repro summary references $MOB_LAB steps only — no unauthorized target paths.
Command guide
Try these commands — Finding row fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP MASTG reporting — https://mas.owasp.org/MASTG/ (finding structure literacy) CVSS mobile context — https://www.first.org/cvss/ (severity framing) Android security tips — https://developer.android.com/privacy-and-security/security-tips
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
python3 - <<'PY'
import os
lab = os.environ.get('MOB_LAB', os.path.expanduser('~/cyberlium-lab/t27-mob'))
path = os.path.join(lab, 'report', 'finding-draft.txt')
os.makedirs(os.path.dirname(path), exist_ok=True)
open(path, 'w').write('
'.join([
'FINDING ID: MOB-LAB-001',
'Title: Exported lab component in YOUR demo.apk (literacy sample)',
'Severity: Informational (lab only)',
'Affected: com.cyberlium.lab.demo — YOUR intentional build',
'Description: android:exported not reviewed in static pass',
'Evidence: unzip -l demo.apk + manifest-review.txt (no live exploit)',
'Recommendation: set exported=false unless required; add intent validation',
'Scope: authorized lab app only — not stranger production apps',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'FINDING|Scope|Evidence' "$MOB_LAB/report/finding-draft.txt"
Primary tools to practice this lesson: python3, grep. Reference sites: OWASP MASTG reporting (https://mas.owasp.org/MASTG/); CVSS mobile context (https://www.first.org/cvss/); Android security tips (https://developer.android.com/privacy-and-security/security-tips). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence discipline
Screenshot hash or log export ID — same integrity habit as DFIR exhibits.
Inference labeled — 'attacker could' not 'attacker did' without proof.
3. Scope refuse
No findings on stranger devices or unauthorized prod apps.
No fabricated evidence rows for capstone drama.
4. What you ship: finding draft template
Ten field template + one completed row from MASVS lab + NEVER fabricated evidence line.
5. What you record before the next lesson
Finding draft template path.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draft finding on popular app without authorization citing internet rumor only.
Right
Finding draft template with one $MOB_LAB row. Next: Severity and Fix.
Mission: finding draft template
1) List ten finding fields. 2) Complete one row from Module 7 lab. 3) Separate observed vs inferred. 4) Write NEVER fabricated evidence.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Repro summary — how much detail?”
Knowledge Check
APPLY: Finding draft requires:
Multiple choice
Knowledge Check
APPLY: True or False: Fabricated finding evidence is lab.
True or False
Knowledge Check
APPLY: Inference in finding should:
Multiple choice