Overview
A finding is only useful if it is evidenced — documented clearly enough to be understood, reproduced, and fixed. This lesson covers collecting evidence during a web security assessment.
Learning objectives
- Explain why evidence is essential to findings.
- Describe what constitutes good evidence.
- Handle evidence responsibly and within scope.
Core concept
Evidence is the documentation that demonstrates a vulnerability is real and reproducible. Good evidence for a web finding typically includes: the affected endpoint/parameter, the reproduction steps, the request/response demonstrating the issue, the observed impact, and supporting artifacts (e.g. screenshots or captured requests). Evidence must be clear, accurate, and reproducible so the owner can confirm the finding and developers can fix it — and it must be handled responsibly, especially when it involves sensitive data.
How it works
As the tester confirms an issue during testing, they capture exactly what shows it: the precise request that triggers it, the response that reveals the flaw, and the steps to reproduce from a known starting state. This turns a claim ("this endpoint has broken object authorization") into a demonstrable fact. Evidence should be minimal but sufficient — enough to prove and reproduce the issue without unnecessary exposure of sensitive data. Any sensitive data encountered is handled per the engagement's rules (protected, not retained beyond need, disclosed only as agreed).
Practical example
For a broken-object-authorization finding, the tester documents: the endpoint (GET /api/invoices/{id}), the reproduction steps (authenticated as user A, request an invoice belonging to user B), the request and the response showing user B's data returned, and the impact (any user can read others' invoices). Sensitive values in the captured response are redacted/handled per the rules. This evidence lets the owner reproduce and confirm the issue and gives developers a clear target to fix.
Cybersecurity relevance
Evidence is what makes findings actionable and credible: without reproduction steps and supporting artifacts, a report is hard to verify and easy to dismiss. Clear evidence accelerates remediation and validation (later lessons). Responsible evidence handling — minimizing and protecting sensitive data — is an ethical and often contractual obligation. This professional discipline distinguishes a useful assessment from a list of unverified claims, and it directly supports the reporting and remediation-verification steps.
Common mistakes
- Reporting findings without reproduction steps or supporting evidence, making them hard to verify.
- Capturing more sensitive data than necessary, or mishandling it.
- Vague evidence that does not let the owner reliably reproduce the issue.
Key takeaways
- Evidence documents that a vulnerability is real and reproducible: affected endpoint/parameter, reproduction steps, the demonstrating request/response, and observed impact.
- It should be clear, accurate, reproducible, and minimal-but-sufficient, with sensitive data handled responsibly per the rules.
- Good evidence makes findings actionable and credible and enables remediation and validation; poor evidence undermines the assessment.
Check your understanding
- What should good evidence for a web vulnerability finding include?
- Why must evidence be reproducible, and how should sensitive data in evidence be handled?