~/tutorials/044-the-deliverable.md

044: The deliverable

Everything in this tier ends in the same artifact. Not a shell, not a flag, not a story. A document a stranger can act on. Lesson twenty-five built the finding shape inside the jail. Here is the whole report.

The report is the only part of an engagement the client's whole organization sees. The exploit impressed one engineer. The report moves budgets.

The parts

Executive summary. One page. What was tested, what was found, in the client's vocabulary. Written last, read first, and the only page most of the audience will open.

Findings. Each one the four fields from lesson twenty-five, and the discipline is unchanged:

cat ~/tutorials/025-the-report-shape.md | head -40

What. Where. Evidence. So what. A finding without the evidence is an opinion, and a finding without the so what is homework.

Reproduction. Numbered steps a stranger runs, from a clean machine, and gets what you got. This is the part that proves the work, and the part that survives you. Six months later the fix gets questioned, and the reproduction is the answer.

Fix. Specific. Not harden the server. The line to change, the setting to set, and what breaks when it is set. A fix section that ignores the breaking is a fix that quietly never happens.

Severity, ranked honestly. Ranked by the client's risk, not your pride. The boring misconfiguration that owns the domain outranks the exotic memory corruption you enjoyed more, and the report that ranks by enjoyment gets treated, correctly, as entertainment.

The voice

The same rule this site runs on. Write what you did, write what came back, write what it means. No adjectives doing the work of evidence, no critical doing the work of inconvenient, and no finding you cannot reproduce on request.

The client does not pay for the exploit. They pay for the sentence that makes the fix obvious.

Try it

1. Attack your own lab for one hour. Anything you find.
2. Write the report. All the parts. One evening is enough for a two finding report and it will be the hardest evening of this tier.
3. Hand it to somebody who did not watch you work. Ask them one question: what would you do first? If the answer is not your top finding, the report failed, and now you know why.