كتابة الـ Finding التقني

finding = {
    "id": "F-01",
    "title": "SQL Injection in login form",
    "severity": "Critical (CVSS 9.8)",
    "affected": "http://10.10.10.5/login.php (username)",
    "description": "User input is added directly to the SQL query.",
    "impact": "An attacker can read the whole customer database.",
    "steps": ["Open /login.php", "Username: admin' OR 1=1-- -", "Logged in as admin"],
    "evidence": "F-01-admin.png (sha256: 3f9a...)",
    "fix": "",
    "references": "OWASP A03:2021, CWE-89",
}

for key, value in finding.items():
    if isinstance(value, list):
        print(f"{key}:")
        for i, s in enumerate(value, 1):
            print(f"  {i}. {s}")
    else:
        print(f"{key}: {value}")

id: F-01
title: SQL Injection in login form
severity: Critical (CVSS 9.8)
affected: http://10.10.10.5/login.php (username)
description: User input is added directly to the SQL query.
impact: An attacker can read the whole customer database.
steps:
  1. Open /login.php
  2. Username: admin' OR 1=1-- -
  3. Logged in as admin
evidence: F-01-admin.png (sha256: 3f9a...)
fix: 
references: OWASP A03:2021, CWE-89

finding = {
    "id": "F-01",
    "title": "SQL Injection in login form",
    "severity": "Critical (CVSS 9.8)",
    "affected": "http://10.10.10.5/login.php (username)",
    "description": "User input is added directly to the SQL query.",
    "impact": "An attacker can read the whole customer database.",
    "steps": ["Open /login.php", "Username: admin' OR 1=1-- -", "Logged in as admin"],
    "evidence": "F-01-admin.png (sha256: 3f9a...)",
    "fix": "",
    "references": "OWASP A03:2021, CWE-89",
}

required = ["title", "severity", "affected", "impact", "steps", "evidence", "fix"]
missing = [k for k in required if not finding.get(k)]
print("missing:", missing or "nothing")

for key, value in finding.items():
    if isinstance(value, list):
        print(f"{key}:")
        for i, s in enumerate(value, 1):
            print(f"  {i}. {s}")
    else:
        print(f"{key}: {value}")

missing: ['fix']
id: F-01
title: SQL Injection in login form
severity: Critical (CVSS 9.8)
affected: http://10.10.10.5/login.php (username)
description: User input is added directly to the SQL query.
impact: An attacker can read the whole customer database.
steps:
  1. Open /login.php
  2. Username: admin' OR 1=1-- -
  3. Logged in as admin
evidence: F-01-admin.png (sha256: 3f9a...)
fix: 
references: OWASP A03:2021, CWE-89

finding = {
    "id": "F-01",
    "title": "SQL Injection in login form",
    "severity": "Critical (CVSS 9.8)",
    "affected": "http://10.10.10.5/login.php (username)",
    "description": "User input is added directly to the SQL query.",
    "impact": "An attacker can read the whole customer database.",
    "steps": ["Open /login.php", "Username: admin' OR 1=1-- -", "Logged in as admin"],
    "evidence": "F-01-admin.png (sha256: 3f9a...)",
    "fix": "Use parameterized queries (prepared statements).",
    "references": "OWASP A03:2021, CWE-89",
}

required = ["title", "severity", "affected", "impact", "steps", "evidence", "fix"]
missing = [k for k in required if not finding.get(k)]
print("missing:", missing or "nothing")

for key, value in finding.items():
    if isinstance(value, list):
        print(f"{key}:")
        for i, s in enumerate(value, 1):
            print(f"  {i}. {s}")
    else:
        print(f"{key}: {value}")

missing: nothing
id: F-01
title: SQL Injection in login form
severity: Critical (CVSS 9.8)
affected: http://10.10.10.5/login.php (username)
description: User input is added directly to the SQL query.
impact: An attacker can read the whole customer database.
steps:
  1. Open /login.php
  2. Username: admin' OR 1=1-- -
  3. Logged in as admin
evidence: F-01-admin.png (sha256: 3f9a...)
fix: Use parameterized queries (prepared statements).
references: OWASP A03:2021, CWE-89