Thinking about the report structure, what do we need a template to do?
A lot of the structure is going to be static or placeholders for other text.
The main dynamic areas are things like the customer's name,
scope details, executive summary, and appendices.
Almost everything else will be static. In a template, it's
very important to make it clear where the dynamic areas
are so they can be updated.
Let's look at what a template in Word might look like.
All of the templates in this course will be available as
exercise files for you to download.
We take a copy of this template for every test we do.
Here, we've got the front cover.
The first thing we notice are placeholders for dynamic sections.
We've made them very obvious.
We don't want the report to go to the customer without
replacing them with the proper text. Scrolling down, we can
see a lot more highlighted sections.
Some have curly braces.
These are intended to be replaced with a specific value.
We've also got other text without braces. Here, the intent is to choose
one or more of the pieces of text. In this instance,
the Carved Rock pen test is a network test, so we'd use
that and delete the rest, removing their highlighting when
we're done. Scrolling further,
we've got the Executive Summary with more of the same, space to detail
key vulnerabilities and more for the summary itself.
Again, this would be a good place for common sets of wording.
If you see a lot of pen tests where they need to improve
patching, for example, then this will make it very simple for
you. In the Finding Summary is a table, and in there, we've got
all of the colors we commonly use.
It's easy to copy them as you need them.
If we were to create some new rules,
we can easily use copy and paste to copy from one cell to another.
There's also a graph.
Now here, it's very simple to create a graph in Excel. Switching to Excel,
we can see an example here.
All we need to do is alter the values for the number of findings we've
got, then copy the graph and paste it into Word. Simple.
This shows some important things to remember.
First, we've got placeholders.
So in our example, placeholders had double braces and were highlighted in yellow.
Double braces make it easy to search the document to see
if we've forgotten to replace anything.
When you think you've finished, search for braces as a final check.
We've also highlighted placeholders in yellow so it's easy to
visually see them. Using both helps us to be really certain
that we've put real values into them.
We include stock phrases so we don't have to think too much. Personally, I can
take far too long writing a single sentence which is accurate, clear, and
concise. If I've written it before, I want to reuse it.
Stock phrases either in the document or kept separately can
be real time savers. Graphs are the same.
We want all the hard work of formatting done already, so we just put a
few numbers into Excel and copy and paste the result.
Finally, color‑coding. We're putting the colors we're using
into the document so it's simple to copy them.
We're trying to save time by doing it. Next, we
need individual finding templates.
It might take a little thought as to how you arrange them.
If you're using something like Microsoft Word, then your
templates will likely be in Word too.
When you copy and paste content from them,
you end up with the format you want. You may want to arrange
them into folders and have strict naming conventions so it's
simple to find what you need.
Let's see what we mean.
Here's a folder for templates with folders for different types of
tests. Looking at network‑specific templates,
we've got different topics. Under Patching, we see some
templates to use. Opening one, we see exactly the same as
we had for the report template.
We've got all of the colors needed, so we can delete those that aren't required.
We've got placeholders for information to be added that's specific to the
finding. And we've got stock text that can be kept or deleted.
We could copy and paste that whole template straight
into our report and edit as required.
That would start to really streamline the process and make it less effort.
The goal here is to save time and reduce errors, so we need to be
sure our templates do both of those things.
Our templates need to make it easy to see where to do things, exactly
where we need to add or remove information and exactly which
information we're unlikely to need to change at all.
They also need to make it hard to forget to do things. When we forget to add
information, that's when errors can start to creep in.