Dated notes, labs and writeups, with the target, the help used and the status of each entry.
· type: note · target: my own system · help used: none · status: reviewed
A business-logic review of a system of mine
I closed a round of adversarial review on a system of mine: hypotheses reproduced in failing tests, fixed at the narrowest boundary and turned into regression tests. All of it in a local environment, with synthetic data.
The lesson I take into testing: the costliest flaws were in concurrency (two requests at the same time) and in the gap between what a business rule promises and what the code guarantees. The full case study is at business-logic review.
I put together a study vault with the PTES structure, the OWASP WSTG test cases and the NIST SP 800-115 process, plus report templates (executive summary, technical report and CVSS severity) and a rules-of-engagement document.
Nothing was run against any target: it’s study and process material. The next step is to use that structure in labs and log each one here.