The Penetration Test Report: From Raw Findings to Client Value

Prerequisites

• PEN-K001: Methodology, Authorisation & Rules of Engagement

Why This Lesson Matters

The report is the deliverable. The client did not hire you to compromise their systems — they hired you to tell them what is wrong and how to fix it. A technically brilliant tester who writes a poor report delivers no value. A methodical tester with a clear, accurate, well-structured report delivers lasting value. This lesson teaches you to write a report that earns client trust and drives real remediation.

1. Report Structure

Penetration Test Report
├── 1. Cover Page
├── 2. Table of Contents
├── 3. Engagement Overview
├── 4. Executive Summary
├── 5. Risk Rating Summary (chart + table)
├── 6. Findings (one section per finding)
├── 7. Remediation Roadmap
└── Appendices
    ├── A. Scope
    ├── B. Methodology
    ├── C. Tools Used
    └── D. Raw Evidence / Screenshots

2. The Executive Summary

One page. Written for the CISO and board. No jargon. Focus on business impact.

EXECUTIVE SUMMARY

A penetration test was conducted against Corp Ltd's external web presence
and internal VPN infrastructure between June 8–22, 2026.

5 Critical and 3 High findings were identified. The most impactful finding
(F001) allows an unauthenticated external attacker to gain complete control
of the finance database server within 2 minutes, without any user interaction.

The root causes are: one unpatched service (Cisco ASA CVE-2020-3452),
two misconfigured internet-facing databases, and insufficient network
segmentation between the DMZ and internal finance systems.

All findings have been communicated to the emergency contact during the
engagement. Critical findings require remediation within 7 days.
A retest is recommended after remediation.

What goes in, what stays out:

3. The Finding Template

Every finding follows a consistent structure. Consistency allows clients to compare, prioritise, and track remediation.

Finding F001 — Internet-Facing MySQL Without Authentication

Severity:       Critical
CVSS v3.1:      10.0 — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
OWASP:          A05:2021 — Security Misconfiguration
ATT&CK:         T1190 — Exploit Public-Facing Application

Affected asset: 185.220.101.10:3306 (MySQL 8.0.32)

Description:
  The MySQL database service on port 3306 is accessible from the internet
  without authentication. An unauthenticated attacker can connect directly,
  enumerate all databases, and read or modify all data.

Evidence:
  Screenshot 1: Nmap output showing port 3306 open and service version
  Screenshot 2: mysql -h 185.220.101.10 -u "" output showing database list

  The following databases were enumerated (no data was accessed beyond
  verifying connectivity and listing databases):
  - finance_prod
  - hr_data
  - customer_records_2026

Business impact:
  An attacker with this access could extract all customer records and
  financial transactions, modify balances, and delete data — causing
  financial loss, regulatory breach notification obligations (PIPEDA),
  and reputational damage.

Remediation:
  Immediate (24 hours):
  1. Add a firewall rule blocking external access to port 3306
  2. Bind MySQL to localhost: bind-address = 127.0.0.1 in my.cnf

  Short-term (7 days):
  3. Review all database accounts; remove anonymous accounts
  4. Implement strong passwords for all accounts

  Long-term (30 days):
  5. Review network segmentation; databases should not be in the DMZ

4. CVSS Scoring in the Report

Every finding requires a CVSS v3.1 vector string and score. Show your work:

Finding F003 — Reflected XSS on Search Parameter

CVSS Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score:  6.1 (Medium)

Justification:
  AV:N — exploitable from the internet
  AC:L — no special conditions required
  PR:N — no credentials needed
  UI:R — victim must click an attacker-crafted link
  S:C  — impact extends to the victim's browser session
  C:L  — limited confidentiality impact (cookie theft possible but not certain)
  I:L  — limited integrity impact (content injection in victim browser)
  A:N  — no availability impact

5. The Remediation Roadmap

After the findings, a prioritised remediation roadmap helps the client's team plan their response:

REMEDIATION ROADMAP

Priority 1 — Within 24 hours
  F001: Block external access to MySQL port 3306
  F002: Apply Cisco ASA patch for CVE-2020-3452

Priority 2 — Within 7 days
  F003: Implement output encoding on all search parameters
  F004: Disable HTTP and enforce HTTPS-only
  F005: Rotate all credentials exposed during the test

Priority 3 — Within 30 days
  F006: Implement network segmentation between DMZ and internal networks
  F007: Deploy MFA on VPN

Long-term improvements
  Enable Content Security Policy
  Conduct developer security training
  Establish a vulnerability management programme

6. Common Mistakes

Mistake 1: Writing a finding with no evidence screenshot. Every finding must have a screenshot or raw output showing the vulnerability was confirmed. "Trust me, I found it" is not professional.

Mistake 2: Vague remediation advice. "Fix the SQL injection" is not actionable. "Replace the dynamic query on lines 47–52 of login.php with a parameterised prepared statement using PDO" is actionable.

Mistake 3: CVSS scores not matching the description. A finding described as "attacker can destroy all company data" scored as Medium (5.4) will confuse the client and undermine your credibility. Ensure score, description, and business impact are consistent.

Mistake 4: No retest recommendation. Remediation without verification is hope. Always recommend a retest after the client fixes Critical and High findings.

7. Practice Exercises

1. Write a one-paragraph executive summary for this scenario: "We found SQL injection on the login page, an exposed admin panel without authentication, and outdated Apache with a known CVE. No evidence of prior compromise was found."

2. Write a complete finding for: "SSH password authentication is enabled on the external-facing server. An attacker can brute-force access without triggering any account lockout."

3. Rank these findings in remediation priority order (justify each): (a) Reflected XSS; (b) Internet-facing Redis without authentication; (c) Missing security headers; (d) Username enumeration on login.

8. Lab

Assessment mode: quiz

You are given a list of 5 findings with incomplete templates. Complete each template by adding: CVSS score, business impact description, and one-sentence specific remediation action. Then order them into a remediation roadmap.

9. Framework Alignment

10. Further Reading

• SANS Penetration Testing Report Template — https://www.sans.org/reading-room/whitepapers/bestprac/sample-penetration-test-report-33343
• OffSec Report Writing — https://help.offensive-security.com/hc/en-us/articles/360046787731
• CIS Controls v8 — Maps directly to common pentest remediation recommendations

["Write a one-page executive summary for a described pentest with five findings that accurately represents business impact without technical jargon", "Complete a finding template with CVSS v3.1 vector string, evidence reference, business impact, and three-tier specific remediation actions (immediate, short-term, long-term)", "Produce a prioritised remediation roadmap for five described findings, ordered by CVSS score and business criticality, with realistic timeframes for each tier"]

Prerequisites → Why this matters → Report structure → Executive summary (template + include/exclude table) → Finding template (full worked example with CVSS justification) → CVSS in report context → Remediation roadmap → Common mistakes → Practice exercises → Quiz lab → Framework alignment → Further reading