1
00:00:00,470 --> 00:00:04,130
Now let's look at some sample testing report.

2
00:00:04,160 --> 00:00:07,880
So I have taken this report from offenses security dot com.

3
00:00:07,880 --> 00:00:11,690
And you can visit a slash report slash sample testing report.

4
00:00:12,650 --> 00:00:18,980
So this way you can write a report where, first of all, you have to mention executive summary.

5
00:00:19,730 --> 00:00:21,410
That is summary of results.

6
00:00:22,190 --> 00:00:28,580
Then you have to mention attack narrative, write what kind of attacks you have used, what kind of

7
00:00:28,610 --> 00:00:34,090
tool or what kind of commands you have used, and what kind of results you have got.

8
00:00:34,100 --> 00:00:36,800
So you have to attach a screenshot, right?

9
00:00:37,340 --> 00:00:45,140
So here are a list of attacks and then you have to mention conclusion, right?

10
00:00:45,170 --> 00:00:49,790
Any recommendations you want to give to your client or to your management?

11
00:00:49,820 --> 00:00:51,620
Then define risk rating.

12
00:00:52,040 --> 00:00:56,890
So there is a proper system for risk rating that is c v s.

13
00:00:56,930 --> 00:00:59,930
We will talk about it a bit more later.

14
00:01:00,530 --> 00:01:04,820
But first of all, you have to mention vulnerability, detail and mitigation.

15
00:01:05,080 --> 00:01:05,670
Okay.

16
00:01:05,750 --> 00:01:08,960
So let's see this report.

17
00:01:11,510 --> 00:01:18,740
So after somebody see, uh, as we have used this command and up, so you have to take a screenshot

18
00:01:18,740 --> 00:01:24,470
of this to expand it to the management that, hey, I have you this command and let's look up.

19
00:01:24,470 --> 00:01:31,160
And what this command does is you have to explain in one or two lines and then what kind of result you

20
00:01:31,160 --> 00:01:32,030
have got.

21
00:01:32,660 --> 00:01:41,090
So you have to mention complete details starting from a using a command or using a tool and then how

22
00:01:41,090 --> 00:01:46,070
that tool works or of what actually it does and the result you got.

23
00:01:46,640 --> 00:01:52,010
And as a proof you can attach a screenshot or even you can record a video as well.

24
00:01:52,430 --> 00:01:53,000
Right.

25
00:01:53,390 --> 00:01:59,840
And you can also draw a diagram to explain management that what a situation would be.

26
00:02:01,700 --> 00:02:07,430
So this way you can explain management in very detail, right?

27
00:02:09,720 --> 00:02:15,780
So this way you can create a basic penetration testing report.

28
00:02:16,140 --> 00:02:18,520
Now, let's talk about risk rating.

29
00:02:18,540 --> 00:02:20,530
I told you about CVS.

30
00:02:20,550 --> 00:02:21,050
Right.

31
00:02:21,060 --> 00:02:22,230
So what it is.

32
00:02:22,230 --> 00:02:25,920
So CVS stands for common vulnerability scoring system.

33
00:02:26,490 --> 00:02:34,200
It provide your vulnerability a numerical number starting from 0 to 10.

34
00:02:34,770 --> 00:02:36,430
If risk rating is ten.

35
00:02:36,450 --> 00:02:40,240
It means it is a very critical weakness.

36
00:02:40,260 --> 00:02:43,330
You have to pay immediate attention towards it.

37
00:02:43,350 --> 00:02:43,950
Right.

38
00:02:44,310 --> 00:02:51,630
So as you can see, CVS provides a way to capture the principal characteristics of a vulnerability and

39
00:02:51,630 --> 00:02:55,530
produce a numerical score reflecting its severity.

40
00:02:56,220 --> 00:02:56,810
Right.

41
00:02:56,820 --> 00:02:59,970
So it goes from 0 to 10.

42
00:03:02,370 --> 00:03:09,330
Now, I hope you know how you can create a sample penetration testing report.

43
00:03:09,630 --> 00:03:12,570
You can visit this report by visiting this URL.

44
00:03:13,380 --> 00:03:22,140
So this is a sample penetration testing report which you have to make once you've done your pen testing.

45
00:03:22,140 --> 00:03:22,740
Right.

46
00:03:23,940 --> 00:03:29,070
And after that, you have to provide risk rating to each output.

47
00:03:29,820 --> 00:03:35,550
Suppose you have got three different kind of weaknesses in your client network, right?

48
00:03:35,550 --> 00:03:42,960
So you have to define that which is okay to live for now and which one we have to focus right now.

49
00:03:43,500 --> 00:03:46,260
So it depends on 0 to 1 risk rating.

50
00:03:46,740 --> 00:03:50,010
So 0 to 10, actually 0 to 10.

51
00:03:50,520 --> 00:03:55,380
So it defines by 0 to 10 as vulnerability risk ratings.

52
00:03:57,510 --> 00:04:00,330
So here are your CV scores.

53
00:04:00,900 --> 00:04:04,080
So if it was zero, which means none.

54
00:04:04,440 --> 00:04:11,820
And 0.1 to 3.9, which means the vulnerability risk rating is low.

55
00:04:12,450 --> 00:04:22,050
And if above 4 to 6.9, it is medium, and then 7 to 9 it is high and then above nine, it is very critical.

56
00:04:22,770 --> 00:04:23,280
Right.

57
00:04:23,280 --> 00:04:30,150
So this way, by using this table, you can define your risk rating in reports, right?