Thuta Learning
Search
AdvancedSecurityintermediate

Reporting & Documentation

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

  • Understand Reporting & Documentation well enough that it stops being intimidating
  • Get hands-on running the tools yourself in an authorized lab environment
  • Be able to apply this concept immediately in a real assessment or report

Let's think about it this way for a second

A professional pentest report has 4 main sections: Executive Summary (a plain-language overview focused on business risk, for management/executives without a technical background), Technical Findings (detail, severity, and reproduction steps for each vulnerability), Risk Rating (prioritizing with a CVSS score or a Critical/High/Medium/Low framework), and Remediation Recommendations (actionable guidance on how to fix each vulnerability). Since the report is the 'output' of the pentest process, good technical skills alone aren't enough — clear communication is just as much a core competency for a professional pentester.

Let's connect it to a real-world scenario

After a lab assessment (Project chapter), you could document a finding like this: 'vsftpd 2.3.4 backdoor vulnerability found (Critical severity, with CVE reference). An attacker can achieve root-level command execution without authentication. Remediation: upgrade vsftpd to the latest version, and disable unnecessary FTP services.' You should include a screenshot or proof-of-concept as well.

Let's look at it together

text
Sample finding entry structure:

Title: FTP Service Backdoor (vsftpd 2.3.4)
Severity: Critical (CVSS 9.8)
Affected host: 192.168.56.101, port 21

Description:
The FTP service is running a version with a known backdoor.
An unauthenticated attacker can gain root-level command
execution.

Evidence:
[screenshot / command output proving the finding]

Remediation:
1. Upgrade vsftpd to the latest patched version
2. Disable the FTP service entirely if not required
3. If FTP is required, restrict access via firewall rules
You should see
You'll be able to write up a pentest finding using the Title/Severity/Description/Evidence/Remediation structure.

Try it in 5 minutes

Write up a report entry yourself, in the format above (Title/Severity/Description/Remediation), for the vsftpd backdoor finding from the Advanced chapter's Metasploit lesson.

A quick word of caution

Send sensitive information from a pentest report (vulnerability details, any credentials obtained) to the client only through a secure channel (encrypted email, file share) — sending the report through a public or unsecured channel risks leaking the very vulnerabilities you found.

Easy traps

  • Writing the Technical Findings section full of jargon and acronyms, then writing the Executive Summary in that same overly technical style — the tone and level of detail need to differ for the two different audiences
  • Leaving remediation as a vague statement like 'fix it' — it's only useful to the client when it includes actionable, specific steps

Now try it yourself

Write up a report entry yourself, in the format above (Title/Severity/Description/Remediation), for the vsftpd backdoor finding from the Advanced chapter's Metasploit lesson.

You'll know it worked when: You'll be able to write up a pentest finding using the Title/Severity/Description/Evidence/Remediation structure.

Reporting & Documentation | Thuta Learning