INFO3002 Ethical Hacking Principles and Practice
Lecture 9B: Writing Penetration Test Report
School of Computer, Data and Mathematical Sciences
Western Sydney University
1
Where we are:
2: Scanning
1:Reconnaissance 3:Exploitation
4: Post
Exploitation
5: Writing
Report
2
Lecture outline
■ Importance of Pentest Report
■ Structure of Pentest Report
■ Some Cautions
3
Importance of Pentest Report
■ The report is often the only tangible result that a client will
receive from a pentesting company.
▬ The face of the pentesting company
■ The client needs to secure its system based on this report.
▬ Of high practical value
■ If you want to win repeated business, you should put great
efforts into this report.
4
Structure of Pentest Report
■ The structure of pentest report can vary among different
pentesting companies.
■ However, in general, the report should include the
following parts:
▬ Executive Summary
▬ A walkthrough of how the pentest was conducted
▬ A detailed list of vulns discovered and solutions
▬ Raw output (optional)
A sample report from Offensive Security Ltd is posted on
vUWS together with this lecture. You should study this
sample report carefully. It is a top-quality sample report.
Most good pentesting companies will post a sample report on
their websites to attract business.
5
The Executive Summary
■ A very brief overview of your major findings.
▬ The audience should be the managers and board members, who
can be non-technical people.
■ If vulns are discovered, the executive summary should
focus on how the vulns will impact business.
■ For each vuln mentioned, a link to the detailed report
about it should be provided.
6
The Walkthrough
■ A step-by-step account on how the pentesting is
performed.
■ To protect the Intellectual Property of your pentesting
company, you can omit the technical details that your
company doesn't want to disclose.
The 'Attack Narrative' section in the sample report
corresponds to this part.
7
The Detailed List of Vulns
■ This part should give a complete list of your findings
(vulns, exploits, solutions, etc.)
■ You should rank the vulns based on their severity levels.
▬ You can use the CVSS mentioned in Lecture 4 as the ranking
method.
■ You should present the vulns with the highest severity
first.
The 'Appendix A' section in the sample report
corresponds to this part.
8
The Raw Outputs
■ It is debatable whether the raw outputs from the tools used should
be included.
■ Supports
▬ The raw outputs are very important for the clients to understand the
detailed report.
■ Objections
▬ The raw outputs will leak the technology secrets of the pentesting
company.
■ So you can include complete, selective, or no raw outputs
according to your company's requirements.
In the sample report, there is no 'raw outputs' section, but
selective 'raw outputs' are included in the 'Attack
Narrative' section.
9
Some Cautions
■ In delivering the pentest report electronically to the clients,
you need to ensure the report is encrypted.
▬ E.g., using 7-zip to do the encryption.
■ Add a note to the client that the pentest report is only a
snapshot in time.
▬ New vulns and exploits appear at lightning speed.
▬ The results of the pentest is only accurate as of today.
■ Double check and polish the report before delivery.
▬ The report is your face/reputation.
10
Lecture Summary
■ Command lines for manipulating Windows Registry and
Windows Firewall are very important.
■ Installing backdoors is a typical activity in Post
Exploitation, since it allows hackers to access targets
easily later.
■ The pentesting report is the main product delivered to the
client. It’s essential for the client to fix its vulnerabilities.
11
References
■ The sample report accompanying this lecture
12
