Lion Cipher Lab
Classify pentest findings by remediation type and find the systemic root cause
- Penetration Testing / Red Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A penetration test report usually ends as a list of findings, each with a severity, and the client works down it worst-first. That is a reasonable start and a poor finish, because it treats every finding as an independent accident. In reality a findings list usually has a few systemic root causes behind it: a dozen separate web vulnerabilities often trace to one missing practice (no input validation, no output encoding), a batch of outdated-component findings to one broken patch process, several exposures to one habit of shipping insecure defaults. The most valuable thing a report can say is…
What you'll learn
- bucketing findings by remediation class from CWE and keywords
- summing risk weight per class instead of per finding
- identifying the systemic root cause behind a findings list
- comparing a systemic fix against fixing the single worst finding
- writing a root-cause recommendation for the report
- the limits of automatic classification
Steps in this lab
- Severity ranks findings; remediation class reveals causes
- The findings list
- Write the classifier
- Run it: the habit behind the list
- Write the recommendation, and check the buckets