How to Write a Better Vulnerability Report

Security teams are humans too. (1337 5p34k not included.)

An example of what NOT to do.

An essential skill for a security researcher is the ability to write concise and clear vulnerability reports. A well-written vulnerability report will help the security team reproduce and fix the issue faster and minimize the possibility of exploitation. In this post, we are going to go into the components of a good vulnerability report and some tips and tricks I’ve learned along the way.

Step 1 of Writing a Good Report: Craft a Descriptive Title and Summary

The first parts of a great vulnerability report would always be a descriptive title and a clear summary.

What is the vulnerability that you have found? Does it correspond to an OWASP top 10? Where is it found on the target? Ideally, the title of the report should be descriptive to the point that it allows the security team you are working with to immediately get an idea of what it is that you are reporting and its potential criticality. For example, instead of saying

Report Title:
IDOR on a critical endpoint

your report title should instead be:

Report Title:
IDOR on "https://example.com/change_password" leads to account takeover for all users

In the first two seconds of reading your report, the security engineer already has a good idea of what is to come in the rest of the report. And in the subsequent summary section, include any additional details that you weren’t able to include in the title, like the post parameters used for the attack, how you found it, and so on.

Report Summary:
The "https://example.com/change_password" endpoint takes two POST body parameters: "user_id" and "new_password". A POST request to this endpoint would change the password of user "user_id" to "new_password". This endpoint is not validating the "user_id" parameter and as a result, any user can change anyone else's password by manipulating the "user_id" parameter.

Step 2: Include a Severity Assessment

It is often helpful to include an honest assessment of the severity of the issue in your report. In…