Vulnerability › Module 8 › Lesson 2
Finding Structure
Title, description, impact, evidence, remediation — one finding block from YOUR lab triage.
Visual · t18_finding_structure
Structured finding = reproducible defender handoff. Original Cyberlium.
Opening
A finding without evidence is gossip — a finding with exploit video on stranger host is a policy violation.
Standard VA finding block: Title, Severity (CVSS + priority tier), Affected Asset (from YOUR inventory), Description (what flaw is), Impact (what could happen in lab context), Evidence (safe verification output redacted), Remediation (patch/version/config), References (CVE/NVD link). Write two complete finding blocks from P1/P2 rows in triage lab. No exploit PoC screenshots, no live credentials, no copy-paste from stranger pentest reports you found online.
1. Required fields
Title: specific — 'OpenSSL 1.0.2 on lab-web-01' not 'Linux vulns.'
Impact: tie to asset role on $LAB_ASSETS — honest lab context.
Command guide
Try these commands — Required fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CVSS in reports — https://www.first.org/cvss/ NVD — https://nvd.nist.gov
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS 'https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228' | jq '.vulnerabilities[0].cve.metrics.cvssMetricV31[0].cvssData.baseSeverity' grep severity "$HOME/cyberlium-lab/t18-finding.txt" 2>/dev/null || echo 'Draft finding after enum'
Primary tools to practice this lesson: jq, grep. Reference sites: CVSS in reports (https://www.first.org/cvss/); NVD (https://nvd.nist.gov). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence line
One safe proof: package query output, header line, config snippet — redacted.
Link triage workbook row — traceability for retest later.
3. Remediation
Vendor fix version, workaround, or compensating control with owner placeholder.
No 'run this exploit to prove' — patch or config change only.
4. What you ship: two finding blocks
Two structured findings from lab triage + field checklist.
5. What you record before the next lesson
Finding blocks path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include Metasploit session screenshot from unauthorized target as evidence.
Right
Write structured findings. Next: evidence hygiene.
Mission: draft two findings
1) Pick two triage rows. 2) Complete all finding fields. 3) Redact evidence; no exploit PoCs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Impact vs Description overlap?”
Knowledge Check
APPLY: Finding evidence should be:
Multiple choice
Knowledge Check
APPLY: True or False: Exploit PoC screenshots required in VA report.
True or False
Knowledge Check
APPLY: Remediation recommends:
Multiple choice