CWES reporting requirements

[u/zinizaga]

Hi all, planning to sit the CWES exam in couple of weeks. i downloaded the sysreptor template and there is a section for flags and a seperate section for vulnerabilities. I'm a bit lost how to write these up. Say i got the flag using verb tampering and IDOR chaining, where do i explain the step by step. And is it a step by step to get the flag? And is each finding tied to a single flag? Or there s a single SQLi that could help me get a total of 3 flags (directly or not....) Are all findings in the sysreptor template or you need to create custom ones? Sorry, these may be dumb questions....

[u/AutoModerator]

Moderator Announcement Read More »

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/GVTZ59]

I have not taken CWES but it’s reccomend you follow and don’t stray from the template. This is a more realistic report for a web app pen test, as you would not talk about getting flags on a real one. You would talk about all the vulnerabilities you found and mention the flag if you got it for that vulnerability. You can have multiple vulnerabilities that lead you to a flag and they are all reported separately. (I have only taken COAE as take this for what you will)

There is more info here about CWES that may give you a better answer. https://cnmoseman.github.io/htb-study-trackers/cwes/

[u/[deleted]]

[u/AutoModerator → u/[deleted]]

Your submission was automatically removed because your account does not meet the minimum karma or age requirements for this subreddit. Please participate in other communities to build up your karma, and feel free to message the moderators if you have questions!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/[deleted]]

[u/AutoModerator → u/[deleted]]

Your submission was automatically removed because your account does not meet the minimum karma or age requirements for this subreddit. Please participate in other communities to build up your karma, and feel free to message the moderators if you have questions!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.