Reporting & Documentation
A penetration test is only as valuable as the report it produces. You will learn how to write professional pentest reports that communicate technical findings to both executive and technical audiences. Clear, actionable reporting is what separates a professional ethical hacker from a script kiddie.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Study a professional penetration test report template
Download the TCM Security sample penetration test report from GitHub — it is one of the most widely referenced templates in the industry and was written by a professional penetration tester. Read through the entire document before writing anything, paying attention to the structure: Cover Page, Table of Contents, Executive Summary, Scope and Methodology, Attack Narrative, Findings sorted by severity, and Appendix. Notice how technical findings are written — each one has a consistent format with Title, Severity, CVSS Score, Description, Steps to Reproduce, Evidence, Impact, and Remediation. Understanding the expected format before you start writing saves significant time and produces a more professional result.
open https://github.com/hmaverickadams/TCM-Security-Sample-Pentest-ReportWrite the Executive Summary for a non-technical audience
The Executive Summary is the most important section of the report because it is the only section most executives will read — write 3-4 paragraphs covering what was tested and when, the overall security posture using language like critical risk rather than technical terms, the single most impactful finding and its business consequence, and the top three recommended actions. Avoid all technical jargon: instead of unauthenticated RCE via CVE-2011-2523, write an attacker with no credentials could take complete control of the FTP server. A useful test: read your executive summary to a non-technical friend and ask if they understand the risk — if they do not, rewrite it until they do.
Document each finding using a consistent template
Create a separate section for each vulnerability using the standard template, where the Title should be descriptive (Unauthenticated Remote Code Execution in vsftpd 2.3.4 is better than FTP Vulnerability). The Severity must match the CVSS score you calculated, and the Description explains what the vulnerability is and why it exists. Steps to Reproduce must be detailed enough that another tester can replicate the finding — include exact commands, payloads, and expected output. Evidence must include screenshots showing the vulnerability being exploited and the resulting access. Impact explains what an attacker could do with this access, and Remediation gives specific, actionable steps to fix the issue.
Capture and annotate evidence screenshots
Good evidence is what separates a professional report from an amateur one — take screenshots at every critical step: the initial scan showing the vulnerable service version, the exploit being executed, the shell prompt showing successful access, and any sensitive data accessed. Use a screenshot tool that lets you annotate, and draw red boxes around the key information in each screenshot so the reader knows exactly what to look at. Name screenshots descriptively: 01-nmap-vsftpd-version.png is better than screenshot1.png. Include the terminal output showing commands and responses, not just the final result — the client needs to understand the full exploitation chain to properly assess the risk.
scrot -s "evidence-$(date +%Y%m%d-%H%M%S).png"Calculate accurate CVSS 3.1 scores for each finding
Use the official CVSS 3.1 calculator at first.org to score each vulnerability, working through each metric carefully: Attack Vector (Network/Adjacent/Local/Physical), Attack Complexity (Low/High), Privileges Required (None/Low/High), User Interaction (None/Required), Scope (Unchanged/Changed), and the three Impact metrics (Confidentiality/Integrity/Availability, each None/Low/High). For the vsftpd backdoor: AV:N (exploitable over network), AC:L (no special conditions), PR:N (no privileges needed), UI:N (no user interaction), S:U (scope unchanged), C:H/I:H/A:H (complete compromise) = CVSS 9.8 Critical. Incorrect CVSS scores undermine your credibility with technical reviewers — take the time to calculate them properly.
open https://www.first.org/cvss/calculator/3.1Write specific, actionable remediation recommendations
Remediation recommendations are where many reports fall short — generic advice like update your software is not useful because the client team needs to know exactly what to do. For each finding, write remediation steps that include: the specific version to upgrade to, the exact configuration change needed, the code pattern to fix with a before/after example if applicable, how to verify the fix was applied correctly, and any compensating controls that can reduce risk while a permanent fix is developed. Also include a remediation priority order — not everything can be fixed at once, and the client needs to know which vulnerabilities to address first to reduce risk most effectively.