🌶 PENTEST-REPORTING

Copy-paste templates and structure for penetration-test deliverables:
rules of engagement, scope, the report itself, findings, severity and
retest. Pair with the Pentest Report Builder tool.

  1. Title page          client, engagement type, dates, version, classification
  2. Document control    version history, authors, distribution list
  3. Executive summary    non-technical; risk posture + headline findings
  4. Scope & approach     targets, window, exclusions, methodology/standards
  5. Findings summary     table: ID, title, severity, status
  6. Technical findings   one per issue (see template below)
  7. Remediation roadmap  prioritised, with effort/owner
  8. Appendices           tools, raw output, methodology detail, glossary

  Client:            <org>
  Provider:          <company / tester>
  Authorization:     signed by <name/title> on <date>
  In scope:          <hosts / URLs / IP ranges / apps>
  Out of scope:      <explicitly excluded assets, 3rd parties>
  Test window:       <dates/times>, timezone <tz>
  Allowed testing:   <e.g. exploitation yes/no, DoS no, social eng no>
  Data handling:     no exfiltration of real PII; redact evidence
  Emergency contact: <name, phone, email> (both sides)
  Deconfliction:     how blue team confirms activity is the tester
  Stop conditions:   what triggers an immediate stop
  Reporting:         format, secure delivery channel, deadline

  <Client> authorizes <Provider> to perform security testing of the
  systems listed below between <start> and <end>. This authorization is
  limited to the listed assets and testing types. <Signatory name/title>
  confirms they have authority to grant this permission.
    In scope: <...>
    Excluded: <...>
    Signed: ____________________  Date: __________

  ID:            F-01
  Title:         <concise, e.g. SQL injection in /login>
  Severity:      Critical / High / Medium / Low / Informational
  CVSS 3.1:      <score>  (<vector>)
  Affected:      <host / URL / parameter>
  Status:        Open / Fixed / Risk accepted
  Description:   What the issue is and how it was identified.
  Impact:        What an attacker could achieve (business terms).
  Evidence:      Minimal, safe proof (redacted request/response, screenshot ref).
  Steps to reproduce:
                 1) ...  2) ...  3) ...
  Remediation:   Specific, actionable fix + reference.
  References:    CWE-__, OWASP __, vendor advisory, CVE-____.

  CVSS 3.1 base -> rating:
    0.0        None / Informational
    0.1 - 3.9  Low
    4.0 - 6.9  Medium
    7.0 - 8.9  High
    9.0 - 10.0 Critical

  Vector metrics (base):
    AV Attack Vector       N/A/L/P
    AC Attack Complexity   L/H
    PR Privileges Required N/L/H
    UI User Interaction    N/R
    S  Scope               U/C
    C/I/A                  H/L/N
  Example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical

  Report severity should reflect BUSINESS risk (likelihood x impact),
  which may differ from raw CVSS - justify any deviation.

  - What was tested and why (one paragraph, no jargon).
  - Overall risk posture in plain language.
  - Count of findings by severity (a small table or sentence).
  - The 2-3 issues leadership must care about, and the business impact.
  - Positive observations (what was done well).
  - Avoid: raw tool output, CVE lists, tester slang.

  - One issue per finding; group only true duplicates.
  - Lead with impact, then detail.
  - Evidence must be reproducible but SAFE (no live creds/PII in the doc).
  - Remediation must be specific ("parameterise queries", not "fix input").
  - Rate consistently; keep a rubric so two testers agree.

  Original finding:   F-01 <title> (was: High)
  Retest date:        <date>
  Result:             Fixed / Partially fixed / Not fixed / Risk accepted
  Evidence:           <what was verified>
  Residual risk:      <if partial>
  New severity:       <if changed>

  - Classify the report (e.g. CONFIDENTIAL / TLP:AMBER).
  - Deliver over an encrypted/secure channel; confirm receipt.
  - Agree retention/destruction of the report and any evidence.
  - Offer a readout call; track remediation to closure.

  See also: REDTEAM-COMMS, RISK-ASSESSMENT, OSCP-METHODOLOGY, PIA-TEMPLATE.
  Interactive tool: /tools/pentest-report-builder