Unit 12: Auditing and hardening · Lesson 5 of 7 · 20 min
Writing the report
Turn evidence into findings with risk and fix, ranked so the team knows what to do first.
mission
- You are
- You are handing over the web01 audit.
- Situation
- You have a timeline, six failed checks and several smaller notes. The team will fix what the report makes clear.
- Goal
- Write each finding in four parts and rank them.
- Hand in
- A ranked list of findings, each with evidence, risk and fix.
A finding in four parts
- Findingwhat is wrong
- Evidencethe exact command and output
- Riskwhat an attacker could do
- Fixthe change and how to verify it
A weak finding and a useful one
SSH is insecure.
No evidence, no fix
Finding: root can log in over SSH with a password. Evidence: grep PermitRootLogin shows yes; 197 failed passwords on 14 Oct. Risk: one guessed password gives full control. Fix: PermitRootLogin no, PasswordAuthentication no, sshd -t, reload, rerun audit.sh.
Anyone can act on it
Ranked findings for web01
| Command | What it does |
|---|---|
1 Critical | Second root account sysops and four persistence items from the 13 Oct session |
2 Critical | rotate.sh is 777 and cron runs it as root |
3 High | SUID root backup-helper outside any package |
4 High | Undocumented listener on 4444, allowed by the firewall |
5 High | SSH allows root and passwords. Firewall policy accept |
6 Medium | Debug endpoint leaks the database password; db.env is 644 |
7 Medium | Web root serves .git/config and a backup; index.html was modified |
8 Low | Leaver still in sudo; stale SSH key; unwiped web00 |
What a defender takes away
- 1Finding, evidence, risk, fix.
- 2Rank by what an attacker gains.
- 3Incidents go to incident response first.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.