Exercise 1: Matching a Discovered Attack Surface to the Site's Own Toolkit — Possible Solution
====================================================================

THE SCENARIO
------------------------------
pentest1-5's scan found: (1) a login form, (2) a product search feature
querying a database, (3) a directly reachable database port on 3306.

(1) THE LOGIN FORM -> BC1 (AUTHENTICATION & SESSION SECURITY)
------------------------------
Per this chapter's own table, "a login form or session-based feature"
maps directly to bc1, which "teaches password storage, sessions, MFA,
JWTs." A login form is exactly the kind of feature bc1's own material
on password storage, session fixation/hijacking, rate limiting against
brute-force, and MFA was built to evaluate — it's the concrete
real-world instance of what that entire course covers.

(2) THE PRODUCT SEARCH FEATURE -> SQLI1 (SQL INJECTION)
------------------------------
Per this chapter's own table, "a database-backed feature accepting
user input (search, filters, login)" maps directly to sqli1, which
"teaches data-vs-code, UNION/blind techniques, parameterization." A
search feature that queries a database using user-supplied input is
precisely the pattern sqli1's own material was built to recognize and
test — whether that input is properly parameterized or could allow an
attacker to inject their own SQL logic.

(3) THE REACHABLE DATABASE PORT ON 3306 -> DBSEC1 (DATABASE SECURITY)
------------------------------
Per this chapter's own table, "an exposed or reachable database port"
maps directly to dbsec1, which "teaches access control, network
exposure, encryption." Port 3306 is MySQL's default port; a database
port being directly reachable at all (rather than restricted to
internal/private network access) is exactly the network-exposure
scenario dbsec1's own material on database infrastructure security
covers — separate from anything about the application code querying
that database.

WHY THIS WORKS AS AN ANSWER
------------------------------
It matches each of the three findings to the specific course the
chapter's own table names for that exact signal, and explains WHY
each match holds using each course's own stated subject matter,
rather than just naming a course without justification.