ROT HACKERSACADEMYStart learning
Courses/Evidence That Holds Up/Lesson 04
04.04 / 50 min

Build a reproducible report

Export sanitized requests, replay steps, identity state, version, target fingerprint, timestamps, and selected findings.

By the endWrite deterministic replay stepsExport selected findingsInclude integrity data
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Complete reproduction metadata

Record WSHawk version, test timestamp, project target fingerprint, identity aliases and expiration state, method, endpoint, object location, policy, and expected versus actual behavior.

02

Generate sanitized reproduction

Create a cURL reproduction with Authorization replaced by a placeholder. Add WSHawk replay steps for teams that use stored identities instead of tokens.

03

Select and export

Export only the confirmed IDOR, GraphQL BOLA, and WebSocket room findings as JSON and Markdown. Use CSV or SARIF when a downstream tool requires structured rows.

04

Verify integrity

Recalculate or verify the exported evidence hashes. Open the bundle on a second path and ensure every finding still links to its sanitized request and response evidence.

MASTERY CHECKPOINT

Prove it before moving on.

Another learner can reproduce the finding from your exported steps without receiving an unredacted secret.