Let us start the last lecture, of course, that is the penetration testing report, and in this lecture
I will show you the components of report, for example, called Page Index, and it will also explain
all of these concepts in detail.
Now, I will be taking the report of the hacker community, which is one of the most well-known community
for bug bounty and report writing.
So I will explain the report and the components as well.
And after the lecture, you will find the report attached in the resources section.
So let us start with the first component.
That is the garbage.
So as you can see on the screen, the hacker one penetration testing report, you can even find this
report from the official website, but they haven't explained each and every component.
So I will explain what is meant by the components of a testing report.
The page that is this is the first page that you are seeing on the screen.
It is known as the code picture.
Now, you always start a report with this cover page.
Now, this is where you would include details such as your company logo title and a shorter description
about the penetration test.
I would suggest you to hire a good designer and work on a professional and appealing garbage, because
if your garbage looks great, it will make a good impression upon the customer who is reading it.
Now, as I said, this is the description of your company next on the table of contents, on the very
next page, you should have an index so that the audience interested in reading a particular portion
of the report can easily get to that portion.
Make sure you highlight or bold the main titles in the table of contents, as well as the page numbers
should be mentioned properly.
The next is the executive summary, we have already discussed what this means about executive summary.
Now, as the name suggests, an executive summary is the portion that is specifically addressed to executives
such as the CEO or the CEO of the company.
The executive summary is the most essential part of meditation testing report.
A good executive summary can make all the difference between a good report and a bad one.
Now, since the executive summary is specifically written to address the non-technical audience, you
should make sure that it's presented in such a way that it is easily comprehensible and understandable.
I will tell you some of the essential points that you should take into consideration while writing an
executive summary.
Make sure you listen to them properly.
The first an important point is since executives are very busy and they have a tight schedule, they
have really minimal time to invest into reading your reports.
Therefore, you should make sure that your executive summary is precise and to the point that executive
summary should start with defining the purpose of engagement and how it was carried out.
Things such as scope should be defined very precisely.
You can see on the screen the goal of this engagement was to conduct a targeted testing and to ensure
the broad coverage of the most common types of vulnerabilities as defined by the website.
So this defines the executive summary in the goal of engagement is also mentioned.
Next, we should explain the results of the penetration testing and the findings in the next paragraph.
You can see on the screen during this assessment, three vulnerabilities were found that had a sevices
rating of seven point zero or higher, either critical or high.
Following this, you should discuss the overall weakness in general and the countermeasures that were
not implemented that caused the vulnerability in the first place.
And finally, you should write about the overall risk that was determined based upon your findings.
You can see they have clearly mentioned how many civil liberties are critical, how many of them are
high, medium and low.
And lastly, you should write about what to what extent the risk would decrease after addressing the
issues and implementing the appropriate countermeasures.
So in short, this is the executive summary.
You can see they have also maintained the state of security.
As I have said, maintaining a healthy security posture requires constant review and refinement of existing
security processes.
Running a hacker on Pantheist allows XCOM internal security team to not only uncover specific, but
gain a better understanding of the security threat landscape.
So this was the state of security for a report.
Now, these are the recommendations now.
What was the key issue for the vulnerability so you can see they have mentioned the key issue, recommendation
and resources.
This is the correct way of telling the recommendations.
So there are three recommendations.
Recommendation one, recommendation two, they might not have included the third one.
They've also mentioned the resources.
You should also provide some images or links if you can.
Next comes the Methodology of Penetration Testing Report.
We have discussed a wide variety of methodologies during this course of penetration testing, such as
or SDMI, NIST and UPS, I would also like to include the methodology that was followed for conducting
the penetration test.
Though its inclusion in the report is optional, it could add a greater value to your penetration testing
report.
In a scenario where you have been asked to follow a certain standard, talking about the methodology
and its steps is a good idea.
Or you can see on the screen of our penetration testing report which methodology was followed in order
to conduct a penetration test.
So you can see they have proper defined the scope and the scope of the assets that which means the websites
in which which are in scope.
They are also included that the assets, otoscope included and other things such as test plan, testing
phase.
Now, this is one of the most important part of penetration testing report.
Not testing phase in which which is the phase which describes the exact process of figuring out the
penetration test, so the first phase is the information gathering and reconnaissance phase in which
you gather as much as information about the target, which is possible.
You document the findings.
Now, in this report, they have just included in half page where if you find more critical information,
you're always welcome to write in detail about the critical information.
The next phase of the testing phase that is the second phase is the penetration testing and the exploitation
phase in which you carry out different attacks, use different exploits and queries to get access to
the system.
Now, you mention about this in the penetration testing phase.
And finally comes the retesting phase and the report is now in the retesting phase, you again confirm
over the week when the results are present or not.
As I said, there are a lot of false positives during a penetration test as a penetration test.
Your job is to verify them manually and finally report phase, which we are doing it now.
We have to report the findings of the vulnerability and you have to always present which when abilities
were present in the system and others.
Now, this is the detailed findings.
Now you can see critical vulnerabilities is a rating of nine to 10 highs from seven to eight point nine.
You have to mention all of these.
This is where you address the technical audience, specifically the security manager and the developers.
Also, this is where you are allowed to talk in depth about how the vulnerabilities were discovered,
root causes of the vulnerabilities, the associated risks and the necessary recommendations.
Now, let's now briefly talk about the findings.
But, you know, these are the findings.
Now, the first and the most important item in the findings is the description.
Description is where you talk about the vulnerability itself, a brief explanation that should be provided
in this section.
So you can see assets, somebody's assets, somebody is in charge.
The description the explanation part is the very reveal the vulnerability was found and how it was found,
the root cause of the vulnerability, the proof of concept and others.
Invulnerability, somebody basically you have to talk about the different types of vulnerabilities you
found a picture speaks a thousand words, is a brilliant quotation that all of us should remember from
childhood, don't we?
Because it always helps us to include the charts in your report.
So if we can see these are the types of charts and tables which are attractive and which help are security
develop or the manager to get a clear idea, things such as the overall strengths and weaknesses and
risk assessment.
Somebody can also be included under this section.
Now, security executives might be interested in this portion of the report as they would need to enforce
the countermeasures.
So just consider yourself as a security expert and reading this speech.
OK, injection test result was good.
So selection.
Yes.
It it didn't find any flaw that was there in broken authentication, synthetic marks or no flaw wherever
there are crosses at that point when the treaties are present.
So this is very critical.
Cyesis over for findings, security, misconfiguration, one finding and below is the RiskMetrics.
I will not tell you what is meant by RiskMetrics, so in short, this is all mentioned in tables, right,
or tabular summary is a great way to present the findings of a vulnerability assessment to a customer.
The following screen comes directly from the report and summarizes the when the assessment based upon
the number of risks and findings, risk assessment is defined as before the analysis of the report.
It is very crucial for the customer because they will want to know the intensity of the damage of the
vulnerabilities.
Now, the risk assessment matrix is in terms of a penetration test.
We compare the likelihood of occurring and impact caused by the risk assessment matrix.
You can see on the screen the following is the following table, which demonstrates critical, high,
medium, low.
And the names of the vulnerabilities is nothing but the risk assessment metrics.
Now in detailed findings, overview of.
Basically, a recommendation is where you address the developers on how to fix the vulnerability.
You may also include general suggestions to avoid that particular class of vulnerability in future.
You can see on the screen the asset, which is the third website, Ippei, dot com, dot com.
This was the asset asset summary is a description when somebody is just we have discussed and, you
know, security is mentioned, CW is mentioned, vulnerability title is mentioned and recommendations
were also mentioned earlier.
You can see the recommendations are mentioned here and the sources and recommendations, not that you
know the basics and the structure of how penetration testing report is basically carried out.
I would urge you to spend some more time removing the following penetration testing reports.
I have attached feelings of offensive security, simplexity report and as well as the hacker report.
These are very good reporting.
Before exploding anything, your job is to write a report and provide it in a proper way.
So in this section we talked about the basic terminologies that we will encounter on a daily basis as
a penetration test.
We discussed about the different types of penetration tests and different types of penetration testing
reports, components of the report, and how to write a perfect report based upon the different target
audience.
Me and my colleague Josh is really glad that you have come through the scores and you've successfully
completed the scores.
Tell this part of the day and I really hope that you like our course.
And before moving ahead, I would just like to urge you to please leave a rating for this course as
it will really boost our confidence in creating more courses.
We have really great courses in our minds, like security auditors, computer network and many more.
So if you want to see more courses, please read rating for us.
Thank you.