A finding is the thing that comes out of security work, and it has to be readable by someone who was not there. This set covers the five parts and their order, why honest severity matters, what a reproduction needs, and why a reader needs a fix as well as a finding.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Write a finding in the five parts
A finding is a title, what you saw, why it matters, how to reproduce it, and what to do, in that order. This writes a finding about a world readable notes file and reads it back. Notice that the reproduce line names the exact command and the fix line names the exact change.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
mkdir -p ~/findings; printf "title: notes.txt is world readable\nobserved: notes.txt has mode 644, so other apps can read it\nimpact: a private note is exposed to anything with storage access\nreproduce: ls -l ~/findings/notes.txt\nfix: chmod 600 ~/findings/notes.txt\n" > ~/findings/notes-permissions.txt; cat ~/findings/notes-permissions.txt
Five lines, one per part, and the reproduce line holds a real command.
the finding opens with a title
the reproduce step names the exact command
it ends with what to do about it
the commands actually ran
What a good answer looks like
Five lines in order: the title, the observation, the impact, the reproduction and the fix. The reproduce line names the exact command, ls, so a reader can run it and see the mode, and the fix line names the exact change, chmod 600. Your own finding would describe a different problem, but the five parts and their order stay the same.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.