Overview
The steps (reproduction steps) are the core of the report — the precise instructions to reproduce the finding. This lesson covers writing clear reproduction steps.
Learning objectives
- Explain the role of reproduction steps in the report.
- Describe writing clear, complete, reliable steps.
- Connect steps to triage verification.
Core concept
The steps are a precise, ordered sequence that lets triage reproduce the finding exactly — the heart of the report. Good steps are clear, complete, and reliable: they specify the starting state (e.g. which test account, any prerequisites), each action in order (the exact requests/inputs), and what to observe at each point, so anyone following them reliably triggers the issue. This is the report's application of the reproduction discipline from the validation module: without clear steps, triage can't verify the finding, and it may be rejected.
How it works
The researcher writes the steps as a numbered, ordered sequence covering: prerequisites/setup (accounts, state — using test accounts), each action precisely (the exact request, endpoint, parameters, inputs), and the expected result at the relevant step (what demonstrates the issue). The steps must be complete (nothing assumed or omitted) and reliable (following them always triggers the finding). Triage follows them to verify the finding, so clarity and completeness are paramount. Vague or incomplete steps ("send a malicious request") force triage to guess and risk rejection. Precise steps make verification straightforward.
Practical example
For the BOLA finding, the steps might be: "1. Log in as test user A. 2. Note test user B's invoice id (e.g. 1002). 3. Send GET /api/invoices/1002 with user A's session. 4. Observe that user B's invoice is returned, despite being logged in as A." Each step is precise (account, exact request, expected observation), so triage can follow them and reliably reproduce the finding. The clear, complete steps make verification straightforward — the core of a strong report.
Cybersecurity relevance
Reproduction steps are the most critical part of the report for triage: they let the program verify the finding is real, which determines acceptance and reward. Clear, complete, reliable steps (with prerequisites, exact actions, and expected results) enable fast verification; vague or incomplete steps cause delays or rejection. This applies the reproduction discipline (validation module) to the report and reflects the findings/reproduction emphasis from the reporting lessons. In high-volume triage, easy-to-follow steps help a valid finding be accepted efficiently — a core reporting skill.
Common mistakes
- Vague/incomplete steps ("send a bad request") that triage can't follow.
- Omitting prerequisites (account, state) needed to reproduce.
- Steps that don't reliably reproduce the finding.
Key takeaways
- The steps are a precise, ordered sequence letting triage reproduce the finding — the heart of the report.
- Good steps cover prerequisites/setup (test accounts), each exact action, and expected results, and are complete and reliable.
- They are the most critical part for triage verification (determining acceptance/reward); clear steps enable fast verification, applying the reproduction discipline.
Check your understanding
- What must reproduction steps include to let triage reliably verify a finding?
- Why are clear, complete steps the most critical part of the report for acceptance?