Write a vulnerability report with severity rationale

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R35 — NVD CVSS & advisory structure

   R40 — OWASP WSTG reporting

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Write a formal, production-grade Vulnerability Advisory & Teardown Report: CVSS/severity rationale, root cause, affected versions, minimal reproduction steps, code fix, automated regression test, and residual risk.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 72 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Completed Vulnerability Teardown Report distinguishing confirmed facts from inference.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R35NIST NVD & CISA KEV↗ nvd.nist.gov

  CVE records, CPE affected-version ranges, CVSS v3/v4 scoring context, and Known Exploited Vulnerabilities catalog.

• R40OWASP WSTG↗ owasp.org

  Web Security Testing Guide: hands-on test cases for authentication, authorization, session, input, and API security.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST · database
  NIST National Vulnerability Database

  Source of the CVE record, CPE applicability statement, and CVSS v3.x/v4.0 vector you must quote verbatim in the advisory's affected-versions and severity-rationale sections.

  R35checked 2026-11-11
• videoCBT Nuggets
  What is a CVE? Understanding Common Vulnerabilities & Exposures

  Connects the CVE list to NVD enrichment and CVSS scoring, which is the chain a reader follows when checking whether your advisory's severity band matches its vector.

  R35checked 2026-11-11
• videoSecurity Journey
  How To Assess the Risk of CVEs

  Shows CVSS plus EPSS used together to justify a severity decision, which is the difference between a bare score and the written severity rationale the report demands.

  R35checked 2026-11-11
• articleITNEXT (Krzysztof Pranczk) · 6 min read
  Best Practices for Writing Quality Vulnerability Reports

  Lays out the finding anatomy — reproduction steps, scored severity with a human-readable band, recommendation, references — that maps one-to-one onto the advisory template you are writing.

  R35R40unchecked 2026-11-11
• repoOWASP (GitHub) · test-case catalogue
  OWASP/wstg

  The test-case identifiers (WSTG-ATHZ, WSTG-INPV, WSTG-BUSL) let you cite the exact minimal reproduction procedure for the class of bug in your teardown instead of inventing steps.

  R40checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.