evidence-capture

Organize security vulnerability evidence by enforcing a consistent directory structure and naming convention. Store HTTP request/response logs, screenshots, and tool outputs under a specific finding ID to ensure reproducible security assessments and clear reporting.

The standard directory structure for capturing proof-of-concept code follows the convention evidence/<finding_id>/<type>_<description>_<timestamp>.<ext>. This taxonomy ensures all vulnerability evidence files are consistently organized and easily referenced during security reporting.

Yes, you can document multiple evidence types for a single XSS vulnerability finding. The method supports capturing malicious HTTP requests, responses, executed payload screenshots, and exploit code snippets, all organized under the same finding ID.

Ensure reproducible security assessments by standardizing the capture of all vulnerability evidence. Enforce specific per-vulnerability documentation requirements, including HTTP logs, screenshots, and configuration files, using strict naming conventions and directory structures.

No specific security tools or dependencies are required. The approach focuses on standardizing the organization of outputs from your existing tools, enforcing a specific evidence taxonomy and directory structure for managing HTTP logs, screenshots, and code snippets.

You should avoid using a standardized taxonomy for vulnerability evidence capture if your security assessment requires ad-hoc, unstructured documentation. This method enforces strict naming conventions and per-vulnerability documentation requirements, which may hinder rapid, informal testing workflows.