gabson0x/pentdem/report-writing

BAD:  "This vulnerability could potentially allow an attacker to access user data."
GOOD: "An attacker can access any user's order history by changing the user_id
       parameter to the target user's ID. I confirmed this using two test accounts:
       attacker@test.com (ID 123) successfully retrieved victim@test.com (ID 456)
       orders, including their shipping address and payment method last 4 digits."

[Bug Class] in [Exact Endpoint/Feature] allows [attacker role] to [impact] [victim scope]

IDOR in /api/v2/invoices/{id} allows authenticated user to read any customer's invoice data
Missing auth on POST /api/admin/users allows unauthenticated attacker to create admin accounts
Stored XSS in profile bio field executes in admin panel — allows privilege escalation
SSRF via image import URL parameter reaches AWS EC2 metadata service
Race condition in coupon redemption allows same code to be used unlimited times

IDOR vulnerability found
Broken access control
XSS in user input
Security issue in API
Unauthorized access to user data

## Summary
 
[One paragraph: what the bug is, where it is, what an attacker can do. Be specific.
Include: endpoint, method, parameter, data exposed, required access level.]
 
Example: "The `/api/users/{user_id}/orders` endpoint does not verify that the
authenticated user owns the requested user_id. An attacker can enumerate any
user's order history, including PII (email, address, phone) and purchase history,
by incrementing the user_id parameter. No privileges beyond a standard free
account are required."
 
## Vulnerability Details
 
**Vulnerability Type:** IDOR / Broken Object Level Authorization
**CVSS 3.1 Score:** 6.5 (Medium) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
**Affected Endpoint:** GET /api/users/{user_id}/orders
 
## Steps to Reproduce
 
**Environment:**
-Attacker account: attacker@test.com, user_id = 123
-Victim account: victim@test.com, user_id = 456
-Target: https://target.com
 
**Steps:**
 
1.Log in as attacker@test.com, obtain Bearer token
 
2.Send the following request:
 

 
3. Observe response:
 

 
The response contains victim's full order history and PII despite being requested
by a different user.
 
## Impact
 
An authenticated attacker can enumerate all user orders by iterating user_id values.
This exposes: full name, email, shipping address, purchase history, and payment
method (last 4). With ~100K users, this represents a mass PII breach affecting
all registered users. Exploitation requires only a free account and takes minutes
with a simple loop.
 
## Recommended Fix
 
Add server-side ownership verification:

 
## Supporting Materials
 
[Screenshot showing attacker's session returning victim's order data]
[Video walkthrough if available]

# [IDOR] User order history accessible without authorization via /api/users/{id}/orders
 
**VRT Category:** Broken Access Control > IDOR > P2
 
## Description
 
[Same impact-first paragraph as HackerOne summary]
 
## Steps to Reproduce
 
[Same structured steps — exact HTTP requests, exact responses]
 
## Proof of Concept
 
[Screenshot/video showing the actual impact]
 
## Expected vs Actual Behavior
 
**Expected:** 403 Forbidden when user_id does not match authenticated user
**Actual:** 200 OK with victim's full order data
 
## Severity Justification
 
P2 (High) — Direct read access to other users' PII. Affects all user accounts.
No user interaction required. Exploitable by any authenticated user.
Automated enumeration could exfil all [N] user records in minutes.
 
## Remediation
 
Add ownership verification: `if order.user_id != current_user.id: raise 403`

# [Bug Class]: [Exact Impact] in [Endpoint/Feature]
 
## Description
 
[Impact-first paragraph. Start with what an attacker can do, not with how you found it.
Include: endpoint, method, parameter, data exposed, required privileges.]
 
## Steps to Reproduce
 
**Environment:**
-Attacker: email=attacker@test.com (standard account, no special role)
-Victim: email=victim@test.com
-Tested: [date]
 
**Reproduction steps:**
 
1.[Login as attacker / visit URL / send request]
 
2.Send the following HTTP request:
 
\```http
METHOD /endpoint HTTP/1.1
Host: target.com
Authorization: Bearer ATTACKER_TOKEN
Content-Type: application/json
 
{"param": "victim_id_here"}
\```
 
3.Observe response contains victim's private data:
 
\```json
{"email": "victim@test.com", "address": "123 Main St", ...}
\```
 
## Impact
 
[Specific, quantified impact. What data, how many users, what can attacker do.]
 
CVSS 3.1 Score: X.X ([Severity]) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
 
## Remediation
 
[1-3 sentence concrete fix. Include code if helpful.]
 
## Attachments
 
[Screenshot or Loom video showing the impact — Intigriti triagers prefer video for complex bugs]

# [Bug Class] — [Protocol Name] — [Severity]
 
## Summary
 
[One paragraph with: root cause, affected function, economic impact, attack cost.
Include numbers where possible: "attacker can drain $X in Y transactions."]
 
## Vulnerability Details
 
**Contract:** `VulnerableContract.sol`
**Function:** `claimRedemption()`
**Bug Class:** Accounting State Desynchronization
**Severity:** Critical
 
### Root Cause
 
[Exact code snippet showing the vulnerable code with comments]
 
## Proof of Concept
 

 
## Impact
 
[Quantified: "Attacker can drain X% of TVL = $Y at current rates.
Requires $Z gas. Attack is repeatable."]
 
## Recommended Fix
 
[Specific code change with before/after]

CVSS = f(AV, AC, PR, UI, S, C, I, A)

1. Exposes PII / health / financial data of other users?        → +1 severity
2. Allows account takeover or privilege escalation?             → +2 severity
3. Requires ZERO user interaction from victim?                  → +1 severity
4. Affects ALL users (not specific condition)?                  → +1 severity
5. Remotely exploitable with no internal network access?        → baseline for High+

[ ] Title follows formula: [Class] in [endpoint] allows [actor] to [impact]
[ ] First sentence states exact impact in plain English
[ ] Steps to Reproduce has exact HTTP request (copy-paste ready)
[ ] Response showing the bug is included (screenshot or JSON body)
[ ] Two test accounts used — not just one account testing itself
[ ] CVSS score calculated and included
[ ] Recommended fix is 1-2 sentences (not a lecture)
[ ] No typos in endpoint paths or parameter names
[ ] Report is < 600 words — triagers skim long reports
[ ] Severity claimed matches impact described — don't overclaim
[ ] Never used "could potentially" or "may allow"
[ ] PoC is reproducible by triager from a fresh state