Although report information will vary based on what the vulnerability is (you might stumble upon encoded-but-decodable sensitive material, which would mean that you wouldn't have any Payload information to submit), there is a common set of fields you will always need:
- The location (URL) of the vulnerability
- The vulnerability type
- When it was found
- How it was found (automated/manual, tool)
- How to reproduce it
- How the bug can be exploited
We've had examples throughout this book of each of these fields, but there are two in particular that deserve greater mention. The location URL is clear, as well as the type, time, method, and all direct information, but ensuring the bug in the report is reproducible and that there's a compelling attack scenario detailing the horrific things it has done, leaving the bug un-patched...
