Writing Reports

Writing the final report is an absolutely crucial part of penetrating testing, and it is often overlooked by enthusiastic hackers. A penetration test report, or simply report, is a document that, as a penetration tester, he/she will issue to their client once all testing is complete. Writing a penetration test report is different from the act of writing a security advisory, which normally contains technical information pertinent only to one or more (related) vulnerabilities, as a report requires the translation of technical knowledge to often nontechnical audiences. One method for scoring issues or vulnerabilities is with the Common Vulnerabilities Scoring System (CVSS). There are different versions of this scoring system. This chapter explains how to obtain a base score for a vulnerability using Structured Query Language injection as an example. The attack vector can be network, adjacent network, local, or physical in nature.