evidence

Overview

Capturing the flag proves to you that the chain worked. Evidence is what proves it to everyone else — and lets the finding be reproduced later. This fourth phase is often skipped by beginners and never skipped by professionals. It draws directly on the forensics mindset from earlier in the path: careful capture, integrity, and a defensible record of what happened and when.

Evidence collection runs alongside the whole engagement on the authorized lab target, not just at the end. This lesson explains what to capture, how to preserve its integrity, and why reproducibility is the real goal.

Learning objectives

• Explain why evidence matters as much as the exploit itself.
• Identify what to capture: screenshots, logs, and hashes.
• Describe chain of custody and integrity for captured evidence.
• Ensure a finding is reproducible from your records alone.

Core concept

Evidence is the durable, verifiable record of what you did and what the target did in response. A finding without evidence is just a claim; a finding with clear evidence is a fact anyone can check. The three pillars are:

• Completeness — enough captured detail that the finding can be understood and re-created.
• Integrity — assurance the evidence has not changed since capture, so it can be trusted.
• Reproducibility — a clear, ordered account of steps that lets someone else reach the same result on the same lab target.

This phase converts your timestamped recon and enumeration notes, plus the exploitation steps, into an organized package that the reporting phase turns into a write-up.

How it works

Good evidence for an engagement typically includes:

• Screenshots — capturing the state at each meaningful step: the vulnerable page, the request and response that confirmed the weakness, the moment the flag appeared. Screenshots show, rather than tell.
• Logs and command records — the ordered list of actions with timestamps: what you sent, what came back, and when. These are the reproducible "recipe."
• Artifacts — copies of relevant files, responses, or the captured flag string itself.
• Hashes — a cryptographic hash (as introduced in the hashes module) of each saved artifact, recorded at capture time. Because a hash changes if even one byte changes, a matching hash later proves the file is unaltered — this is the integrity pillar in practice.

Chain of custody is the documented history of each piece of evidence: what it is, when and how it was captured, its hash, and how it has been stored since. In a lab this is practice for real work, where chain of custody can determine whether evidence is admissible. The test of the whole package is simple: could a competent peer reproduce this finding using only your records? If not, capture more.

Practical example

For the lab chain from the previous lesson, your evidence package might contain:

1. A screenshot of the login form and the response confirming the authentication bypass, with a timestamp.
2. A log of the exact ordered steps: the request that bypassed auth, the admin page reached, the upload used to pivot, and the request that revealed the flag.
3. The flag artifact — the captured flag{...} string saved to a file.
4. A hash of that file (and of any saved responses), recorded next to each, so their integrity can be verified later.
5. A short chain-of-custody note: "captured during session on lab target at recorded times; stored in engagement folder; hashes above."

Weeks later, a reviewer can follow your log on the same lab target, reproduce the flag, and confirm your saved artifacts are unchanged by re-computing the hashes.

Cybersecurity relevance

In professional testing and especially in incident response and forensics, evidence quality is everything. A brilliant exploit with no reproducible evidence may be dismissed; a well-documented finding drives remediation and, when needed, holds up to scrutiny. Hashing for integrity and documented chain of custody are core forensic practices — the same ones that make digital evidence trustworthy in investigations. Building these habits in a lab means they are second nature when the stakes are real.

Common mistakes

• Capturing evidence only at the end, missing the intermediate steps that make the finding reproducible.
• No hashes, so integrity cannot be demonstrated and altered files cannot be detected.
• Vague notes ("bypassed login somehow") that no one, including future-you, can reproduce.
• Disorganized storage with no chain-of-custody record, so evidence provenance is unclear.

Key takeaways

• Evidence turns a claimed exploit into a reproducible, verifiable fact; it is captured throughout the engagement, not just at the end.
• Capture screenshots, timestamped logs/command records, artifacts, and cryptographic hashes for integrity.
• Chain of custody documents each item's origin, hash, and storage — a core forensic practice.
• The standard to meet: a competent peer can reproduce the finding on the lab target from your records alone.

Check your understanding

• Why does recording a cryptographic hash of an artifact at capture time support the integrity of your evidence?
• What is chain of custody, and why does reproducibility depend on capturing intermediate steps?