ROT HACKERSACADEMYStart learning
Courses/Evidence That Holds Up/Lesson 05
04.05 / 45 min

Retest and classify the outcome

Rerun a saved finding and distinguish still vulnerable, fixed, authentication expired, endpoint changed, and inconclusive results.

By the endUse the original evidence as baselineRecognize auth expiryAvoid false fixed classifications
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Retest the secure baseline

Duplicate the confirmed IDOR finding, change its endpoint from resources-insecure to resources, and run Retest with the original User A and User B identities.

Expected result

User A receives 403 while User B receives 200.

02

Classify fixed behavior

Because the original exposure no longer occurs and authentication is valid, classify the retest as Fixed and preserve both original and new response hashes.

03

Recognize expired identity

Delete or invalidate one saved identity and rerun. A 401 caused by missing session state is Authentication expired, not Fixed.

04

Recognize endpoint drift

Change the path to a nonexistent route. A 404 means Endpoint changed. Network failures or ambiguous cleanup produce Inconclusive.

MASTERY CHECKPOINT

Prove it before moving on.

Your retest history contains one Fixed, one Authentication expired, one Endpoint changed, and one clearly explained Inconclusive example.