Exercise 2: Why "I Could Have" Is the Professionally Correct Stopping Point — Possible Solution ==================================================================== THE CLAIM BEING EXPLAINED ------------------------------ "I could have extracted the entire database" is often the professionally correct stopping point, even though the tester technically could go further. EVIDENTIARY VALUE PLATEAUS ONCE EXPLOITABILITY IS PROVEN ------------------------------ Per this chapter, "once a vulnerability is confirmed exploitable in principle... extracting every row or every session isn't 'being more thorough.'" The purpose of exploitation, per this chapter's own opening section, is to determine "whether [a candidate is] actually real, actually exploitable, and what genuine impact it enables." A single successful extraction already answers all three of those questions completely: yes it's real, yes it's exploitable, and the impact (arbitrary data access) is already demonstrated by the fact that ANY unauthorized row was successfully retrieved. Retrieving a second row, a hundredth row, or the entire table provides no additional information relevant to those three questions — the proof was already complete. ADDED RISK WITHOUT ADDED PROOF ------------------------------ Per this chapter, going further only adds risk: "extracting an entire customer table, or modifying/deleting real data" crosses from demonstrating a weakness into actually exposing real, sensitive information belonging to real people, with no compensating benefit. The client doesn't need MORE proof to fix the vulnerability — a fix is required whether one row or the whole table was accessed. So continuing further only increases the actual harm/risk of the engagement itself without increasing the value of the finding being reported. WHY "I COULD HAVE" IS THE CORRECT PHRASING, NOT A LIMITATION ------------------------------ Per this chapter, stopping after a single non-sensitive record "is both scientifically sufficient and the professionally correct choice — not a missed opportunity." The phrase "I could have" demonstrates the SAME level of technical capability and confidence in the finding as actually doing it would — the tester is stating, with evidence, that the access clearly existed, while deliberately declining to exercise it beyond what was needed to prove the point. This is exactly the discipline this chapter's warn-box ties to authorization not being a blank check: choosing not to go further is what keeps the tester's actions safely within what a signed authorization actually covers. WHY THIS WORKS AS AN ANSWER ------------------------------ It separates the two distinct reasons the chapter gives (no added evidentiary value, and real added risk) and explains why stopping early is a demonstration of professional judgment rather than an incomplete test.