You need to make sure that you're presenting value to your client.
So writing a penetration testing report is a very important aspect of your penetration testing cycle.
The report will be sent to the client and we'll be directed to different audience from the senior management
and the technical team as well.
A lot of currently available courses out there like shedding the light on penetration testing report
skills.
However your work is useless without something tangible and useful.
You give to your client the report should detail all the outcome and the tests you've done as well as
your recommendations on how to mitigate different security risks.
So your final product here is actually a report that shows the service you have provided the methodology
you've adopted as well as the results and recommendations you might consider that this is the least
interesting part of your penetration testing cycle.
You might be right.
It might be dry but without it the clients will not see the result of your efforts.
And in reality the report is a very essential part of conducting business with clients.
The adopted methodology comprises of these five stages.
First we plan on how to write and address our report.
Second we do information collection.
Third we write the first draft.
Fourth we review and finalize the report.
And finally we send it to the client.
The first phase is the report planning phase which comprises the following sub phases.
The objective of the engagement is very important to highlight.
It's mainly the objective set by the client.
You should as well highlight any assumptions such as in scope and out of school systems.
You should as well mention the time you will do your testing.
This can be for many reasons such as the presence of key I.T. personnel as well as not to interfere
with important releases and changes done to the production and as well to protect yourself.
You should as well consider the target audience because as we said the audience varies from business
stakeholders to technical people.
You should keep in mind the position of the people in the organization.
The knowledge they should have about this report and their responsibility and authority to make decisions
based on the report.
The report should as well be classified the highest.
Based on the information classification policy of your client.
So if your client is using the US military classification it should be classified as top secret.
You should as well maintain a clear report distribution strategy.
It's advisable to print out the reports and hard copies and deliver them to the right persons in hand.
The second phase is the information collection phase.
You need to make sure that you have collected all the information in all stages.
You need to mention the systems you used and the tools as well.
This will ease the report writing and make all the information you need available on each stage.
There are two approaches here.
You can analyze the results you've collected during the information collection phase or during the test
itself or you can leave the analysis to the report writing phase.
Under all circumstances you need to collect the necessary information such as scan results vulnerability
assessment.
You need to take screenshots of the exploits you found.
You need to highlight you need to put some comments you need to show the logs you can as well use some
documentation tools such as pointers or w s that we will see in the next session.
Now you need to start writing the first draft of the report using all the relevant information you collected
earlier.
This is a very important stage and it actually consumes up to 70 percent of the report writing time.
In this phase you will use symbols to mask some tasks that you need to check on later and you can as
well later delete such symbols before delivering the report to your client.
You need to review it internally.
Peer review is highly recommended as a second opinion.
If you're working within a team all the team members need to review you and edit the report after that
quality assurance team need to be involved to do further reviews and changes to make sure it follows
your company's standards.
In a sample report layout you need to make sure that you've decided upon the page design such as look
and feel in terms of header footer the font and the colors you'll use.
You will as well include Document Control which will be based on your document control procedure.
It is recommended to have a cover page that chose the name of the report version the date and the name
of your company which is providing the service.
Include a table of contents that will list all the sections of the report in a sequence with page numbers.
Also include List of Illustrations containing tables and charts that you have used in the report.
List them in the section with the page number as well in the executive summary section.
Think of what you will say if you are presenting your report to the board members.
The executive summary target executives where high level findings and issues need to be raised and discussed.
You normally write this section after writing the full report.
You need to put the scope of work that clearly identifies the scope of the project.
The IP addresses that have been tested and the type over the penetration testing you have performed
provide the objectives that the organization will gain after knowing the risks related to the penetration
testing of the target systems.
In case there are some assumptions that the pen testers consider before or during the test the assumptions
need to be clarified and highlighted.
The timeline will show the penetration testing start and end dates.
That testing duration since you don't want to hold any responsibility of some risk aroused after the
period of time due to some changes in the target systems in a glance view showed a number of discovered
risks based on priorities and the summary of finding section and in the summary of recommendations based
on the analysis of risks and the high level findings.
The high level recommendations for the target systems need to be described in the methodology section
the needed information about how the penetration testing was conducted need to be there.
What steps have been followed in order to collect information analyze them.
The risk creating methodology you have used to calculate the risks for each piece of vulnerability and
it may also contain the tools that the penetration tester used to collect such information and the detailed
findings section present the findings in the most simplest way is possible for each finding.
Describe the threat level the vulnerability rating analysis of the issue and the impact on the information
asset the system you have tested risk rating and recommendations.
There are a number of ways in which results can be presented.
You can present them in tabular format graphical format.
You can use charts like buy or bar charts.
You can even use diagrams for each piece of vulnerability include description should be shown about
the social vulnerability its impact and the likelihood of the vulnerability to be exploited.
Reports should explain the source of the vulnerability and the root cause of the problem itself.
You should as well highlight the likelihood of occurrence and the impact in case those vulnerabilities
were exploited.
You should as well use risk evaluation techniques which is a process of comparing the estimated risk
against a given risk criteria to determine the significance of the risk.
You might refer to some ISO standards in this scenario.
Finally in the recommendation and based on the risk rating and the target asset value the penetration
tester should provide an acceptable recommendation with alternatives and you can provide more than one
option for the client in order to mitigate the risk.
At the end of the report it is important to give precise details of all the work by other authors which
have been referred to within the report includes some glossary that details the author name date of
publication title of the book the publisher and the page numbers that you have used.
Also include an appendix that can have additional information related to the report.
I will now show you some sample penetration testing reports from the Internet just to tell you that
there is nothing right or wrong about the format.
You can do your own as long as you abide by the general guidelines.
You can see the logo of the provider is here.
The title of the report and the service provided to the client here.
This is the version control information the author and the ad receives a nondisclosure agreement is
appended to the report here as well disclaimers.
This is the the content.
As you can see the purpose of the engagement and the scope of the engagement along with the summary
of the findings that very key.
Then there is a conclusion.
If you scroll down you can see that the purpose is just a simple paragraph along with the scope targeting
this application here this is a summary of the findings for the executive summary of a finding but in
a tabular format with the classification of the risk now we go into the risks one by one I can see screenshots
because you classification of the risk and the complexity of the attack can be performed by amateurs
or experts or hackers etc. As you can see all the information about this about each of the attacks is
included in this summary at the end of the report
you will see a conclusion with the list of the risks and the rating along with the page references.
Another report is from offensive security here.
Executive summary at first the types of attacks.
Then the conclusion.
Its layout is kind of similar to the previous one with a summary of findings.
Executive Summary now each of the attack is explained along with screenshots screenshots diagrams again
screenshots.
If you go to the end of the report you will see that there are two appendices.
Appendix A an appendix B Appendix A has the full description of each of the vulnerabilities found description
of the vulnerability along with as its rating the impact and the remediation on the recommendation
and Appendix B actually is about the the vendor.