Evidence Chain Methodology
How PhantomYerra captures, preserves, and verifies forensic-grade evidence for every confirmed finding — from raw capture to chain-of-custody integrity.
Why Evidence Quality Matters
A vulnerability report without evidence is an opinion. A vulnerability report with forensic-grade evidence is a fact. PhantomYerra captures evidence at the moment of discovery — not reconstructed later, not summarized, not inferred. Raw requests, raw responses, extracted data, timing measurements, and cryptographic hashes that prove the evidence has not been modified since capture.
Evidence Collection Pipeline
Eight Evidence Components
1. Raw Request
The exact HTTP request as sent to the target: method, URL, headers (including cookies, authorization tokens, content-type), and body. Nothing is omitted or sanitized. This is the precise input that triggered the vulnerability.
2. Raw Response
The complete HTTP response from the target: status code, all response headers, and full response body. This proves the server's exact behavior in response to the attack payload.
3. Timing Data
Request-to-response latency measured in milliseconds. Essential for confirming time-based blind vulnerabilities where the only signal is a measurable delay in the server's response time.
4. Extracted Data
Any data obtained during exploitation: database records, credentials, API keys, PII, configuration values, internal network information. Cataloged and classified by sensitivity level.
5. SHA-256 Hash
Cryptographic hash computed over the complete evidence package (request + response + timing + extracted data) at the moment of capture. Any post-capture modification of the evidence will produce a different hash, proving tampering.
6. RFC 3161 Timestamp
Trusted timestamp establishing exactly when the evidence was captured. This is applied at capture time, not at report generation time. Proves the finding existed at a specific point during the engagement.
7. PoC Script
A copy-paste ready script or command that reproduces the finding independently. The client or their remediation team can run this command to verify the vulnerability exists before applying fixes, and again after fixes to confirm remediation.
8. Chain Context
Reference to the attack chain this finding belongs to, including predecessor findings (what enabled this finding) and successor findings (what this finding enables). Provides the full exploitation narrative context.
Sample Evidence Package Structure
Integrity Guarantees
- Hashed at capture time. Evidence is hashed immediately when captured — before any post-processing, before report generation, before any human reviews it. The hash proves the evidence is unmodified.
- Hash chain links findings. Each finding's evidence hash is linked to the engagement record, creating a chain where modifying any single finding would break the chain.
- Timestamps at capture, not generation. Timestamps record when the evidence was captured during the live engagement, not when the report was generated hours or days later.
- Immutable after capture. Once captured and hashed, evidence cannot be modified without producing a different hash. The report includes the original hash for independent verification.
Chain of Custody
For engagements requiring legal-grade evidence, PhantomYerra maintains a full chain of custody log:
| Event | Recorded Data |
|---|---|
| Evidence Captured | Timestamp, finding ID, engagement ID, evidence hash, capture method |
| Evidence Stored | Storage location, encryption status, access controls applied |
| Evidence Accessed | Who accessed, when, for what purpose (report generation, review, export) |
| Evidence Exported | Export format, destination, hash verification at export time |
| Report Generated | Which findings included, evidence hashes embedded in report, report hash |