Why Report Writing Matters
In ethical hacking and penetration testing, technical skills are only part of the equation. Delivering clear, structured, and actionable reports is what helps clients fix security flaws and make informed decisions. A well-written report can elevate your credibility and the impact of your work.
📌 Key Components of a Pentest Report
- Executive Summary: Non-technical overview for managers and stakeholders.
- Scope & Methodology: Defines what was tested, and how.
- Findings: Vulnerabilities discovered, with evidence and severity.
- Risk Ratings: CVSS or custom scoring to show priority.
- Recommendations: Practical mitigation guidance.
- Appendix: Tools used, raw logs, and full requests.
🧠 Step-by-Step: How to Write a Pentest Report
Step 1: Start with the Executive Summary
Write a one-page overview that explains the overall risk posture and business impact. Avoid jargon.
Step 2: Define Scope and Methodology
Explain what targets were tested (domains, IPs, apps) and what techniques were used (automated/manual, OWASP Top 10, etc).
Step 3: Document Findings Clearly
Each vulnerability should include:
- Title + Description
- Impact
- Proof of Concept (PoC)
- Risk level
- Recommendation
Step 4: Assign Risk Ratings
Use CVSS 3.1, OWASP Risk Rating Methodology, or a custom model. Always explain your rating.
Step 5: Provide Remediation Guidance
Don't just say "sanitize input" — provide technology-specific fixes.
Step 6: Use an Appendix for Logs and Tools
Include detailed command outputs, scanner results, HTTP requests, etc.
🌐 Real-World Example
🔒 Title: Reflected XSS on Login Page
Impact: Allows attacker to steal session cookies via crafted URL.
PoC:
https://target.com/login?redirect=Recommendation: Encode user-controlled parameters using proper output encoding (e.g., HTML encode with OWASP ESAPI).
💡 Practical Tips
- Write in plain, concise English – avoid overly technical explanations in the summary.
- Use screenshots and HTTP request/response blocks for clarity.
- Validate severity with business logic – not just CVSS numbers.
- Use consistent formatting and terminology throughout.
- Use version control (like Git) for drafts and collaboration.