How do I see the exact payload used to prove a finding?

Steps

1. Go to Issues and click the finding's row. Or use a scan's Findings tab.
2. Click the Evidence tab.
3. Look under the Authentication line for Payload injected.
4. Copy the text from the code block if you want to reuse it in a test that you are allowed to run.

Good to know

This block shows the exact payload, which makes it easy to see which field carried it, because the same text appears in the body of the HTTP request block just below. Short and traceable.

Read the payload together with the Description on the Summary tab. The description names the field or parameter involved and explains why the input worked. Together they tell your developers where to look and what to change, which saves a lot of back and forth in a fix ticket.

• Never paste a payload into a system you are not allowed to test.
• For the full sequence, not only the input, follow the Reproduction steps.
• Treat the payload as evidence, not as a secret, since it is just text that the scan sent.

If a finding has no Payload injected block, check the request block for what was sent. Weaker findings, graded Likely or Unconfirmed, can carry less evidence than Confirmed ones. See how to see the request and response and how to reproduce a finding.

Related questions

• How do I see the HTTP request and response that proved a finding?
• How do I reproduce a finding myself?
• How do I see the full details of a finding?
• Where do I find the screenshot captured as evidence?
• Why aren't any of my findings marked Confirmed?

Full tutorial

How to read a finding in Cyberlop: Summary and Evidence

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre