Let us start the last section of this wonderful cause till now, you have seen how to carry out a penetration
test, different ways of getting out a penetration test, exploding target information gathering and
scanning and so more.
But after this, you should be able to present the findings and document it properly.
And there comes the need of writing up penetration testing report.
In this section, we will learn how to write a proper penetration testing report, and I will be explaining
the 10 template of writing up additional testing report.
So let us start now.
What are some key factors in order to present a good report?
Now, first, your report should be simple, clear and understandable in any penetration test.
The report is the most crucial part of writing.
A good report is the key to successful penetration testing.
Presentation of the report is also important how those photos, appropriate forms, will spaced margins,
images, etc. should be created and selected properly with great care.
Now, for example, if you are using a rare form for the hearing, every hearing in the document should
be in that state.
The report should be well-organized.
Correct, spelling and grammar is very important.
A misspelled word leaves a very negative impact upon the person who is reading your report.
So you should make sure that proofreading your report and performing spell checking before submitting
it to the client is an important task.
Always make sure that you use a consistent voice and style in writing a report, changing the voice
or create confusion in the reader.
So you should choose one voice and style and stick it throughout your report.
Now, make sure you spend time on eliminating false positives.
Now, if you use an automated scanner, it may generate some false positives when the readings that
are actually not present are known as false positives.
Now, these false positives will always be there no matter what you do, so it is your job to perform
a manual test again on the target and then verify the penalties which are actually present.
And this would enhance the credibility of your report.
Perform a detailed analysis of the vulnerability to find out its root cause a screenshot of raw HDB
request or the screenshot that demonstrates the evidence of finding would give a clear picture to the
developer of the status.
Now, it is important that you should understand the audience while writing a report.
It's not like the entire report is just in terms of technical.
So understanding the audience that would be reading your penetration testing report is a very crucial
part of the penetration test.
Now, we can divide the audience into following three categories, which you can see on the screen.
The first one is the executive class report.
The second is a management class report and the last is a developer report.
While writing a report, you must understand which audience will read which part of your report.
For instance, let's consider the company's CEO would not be interested in which exploit you used to
gain access to a particular machine or venerability.
And on the flipside, your developers are not at all interested in overall risks and potential losses
to the company.
They are just interested in which exploits you have used.
So while writing a report, it would be very important to write a report keeping in mind with these
three types.
The first one is the executive class report.
This category includes the CEO of the company, since they have a very tedious schedule and most of
the times they have less technical knowledge, that would end up leading a very small portion of the
report.
For example, if your vulnerability may result in 10 billion dollar loss, then they are interested
in reading that part.
They are not interested in reading which vulnerability you have used to exploit the flaw.
So specifically, the executive summary remediation report, etc., these people end up reading a very
small, small part of a report and hence they're interested only on the business impact now, which
we will discuss later in the schools while demonstrating a proper template of a report.
Now, let us move on to management class, which includes the CISO, that is chief information security
officers, and the CISSP, that is chief certified system security professional.
Now, since they are the ones who are responsible for implementing the security policy of the company.
They will probably be more interested in reading about the overall strengths and weaknesses of the report.
For example, if you spotted a vulnerability, they might be interested in reading which vulnerability
was exposed and how it works.
Alerted.
Last comes the technical class or the developer report.
Now, this report includes a security manager and developers who would be interested in reading your
report thoroughly, they would investigate your report as they are responsible for patching the vulnerabilities
found and for making sure that the necessary patches are implemented.
So let us consider an example of you exploiting a crippling vulnerability and injection injection.
Now, when you write a report for the executive class, you just have to write how much loss the company
will face in terms of amount or in terms of users.
And on that figure, the CEO of the company is more interested in how when it comes to management class
report, you will include rich venerability was exploited, how it was exploited and what can be the
business impact, and a bit more technical knowledge like the description of the vulnerability.
And when it comes to developers report, you have to mention everything right from which expert you
used, which because you used which statements ask queries were used, the screenshots, the proof of
concept references and etc. everything should be included in developer report.
In the next lecture, we are going to get into the essentials of reporting fees in which I will teach
you about the structure of a report.
We have discussed what a good report should look like.
I pointed out that knowing your audience is very important, that one of the key factors about a good
report is that it should meet the needs for each audience and be presented in a clear and understandable
manner.
The next major part of writing a report is the analysis where we perform risk assessment and calculate
the overall risk to the organization based upon our findings.
So in the next lecture, we will see how to write a report and its components of penetration testing
report.