Take an injection from signal to a report-ready finding

applied · 85 min · Objective 4.4

Task

Take a SQL injection in your own app all the way to a report-ready finding — evidence, impact for this application, safe reproduction, and remediation at the level of the cause — capturing everything as client data would be handled. Objective 4.4 is web application attacks, and this is where a flaw becomes a finding.

Steps

  1. On the lab you own, take the vulnerable application from the short lab.
  2. Establish the injection with a safe signal, and capture the request and response as evidence, masking any real value.
  3. Write the impact for this application: not "SQL injection", but what an attacker reaches through it here — which tables, whose data, and whether it reaches authentication.
  4. Write a safe reproduction the client's engineer can run: the exact parameter and injection string that produces the signal, not a destructive extraction.
  5. Assign severity: base score, adjustment for this app's exposure and data, and the reason.
  6. Write remediation at the cause — parameterised queries across the codebase, not an escape on this one field.

Verify

grep -cE "^##\s+(Evidence|Impact|Reproduction|Remediation|Severity)" /tmp/finding.md
grep -ciE "this application|these tables|reaches|whose data" /tmp/finding.md
grep -cE "REDACTED|\*{3,}|<masked>" /tmp/finding.md

The first count must be 5 — the finding has all four parts plus severity. The second must be non-zero: the impact is written for this application specifically, not the generic vulnerability class, which is what lesson 6 requires. The third must be non-zero: the evidence masks real values, because proving the injection does not require shipping extracted data with the report.

Notes

The impact statement is where a finding is won or lost — "allows SQL injection" is a class; "an unauthenticated user can read the customer table, including the password hashes shown masked below" is a finding. Remediation at the cause fixes the pattern, not the instance you happened to find. Everything ran on your own application, and the extracted evidence is handled as client data would be.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.