How to Write a Professional Pentest Report

Why is a Pentest Report Important?#

A penetration test report is the only tangible deliverable provided to the client. It serves to:

• Document all discovered vulnerabilities
• Propose clear and realistic solutions
• Help decision-makers understand business risks
• Serve as a baseline for future fixes and audits

A good report should be understandable by both technical (e.g., DevSecOps) and non-technical stakeholders (e.g., executives, project managers).

It is a skill often ignored by junior pentesters until they’re required to do it.

Recommended Structure for a Good Report#

Based on professional standards (PTES, OWASP), a good report is typically divided into the following sections:

1. Assessment Overview#

Objective#

• Describe the goals of the test: identify vulnerabilities, validate controls, etc.

Methodology Used#

• PTES, OWASP Testing Guide, NIST SP800-115...

Example:#

Methodology: PTES (Planning → Discovery → Attack → Reporting)
Test Date: 01/05/2025 - 02/05/2025
Duration: 2 days
Team: RedTeam VulnTrust

2. Severity Ratings#

Purpose:#

• Provide a clear risk overview to help the client prioritize remediation efforts.

Based on CVSSv3:#

Example Use:#

The SQLi vulnerability is classified as Critical (CVSS 9.8) because it allows authentication bypass without credentials.

3. Risk Factors#

Objective:#

Analyze each vulnerability based on two criteria:

• Likelihood (how likely it is to be exploited)
• Impact (what damage it causes)

Example:#

4. Scope#

Purpose:#

Define what was explicitly authorized for testing and what was excluded.

Include:#

• Domains, IPs, and web applications tested
• Timeframe (if specified)
• Written authorization (e.g., contract or email)

Example:#

In-Scope:
- https://example.com
- IP Range: 192.168.1.0/24
 
Out-of-Scope:
- Payment API
- Internal Network

5. Executive Summary#

Purpose:#

Provide a high-level summary without technical details, targeting decision-makers (e.g., CISO, CEO).

Should Include:#

• Total number of findings
• Overall risk level
• Strengths and weaknesses
• Strategic recommendations

Example:#

Summary:
- 6 vulnerabilities identified (2 critical, 3 medium, 1 low)
- Major risks: SQL Injection, exposed admin access
- Security strengths: WAF enabled, secure session handling
- Recommendation: Fix critical issues immediately and schedule a retest within 30 days.

6. Technical Findings#

This section is the technical core of the report. Each finding should be detailed, clear, and verifiable.

For each finding:#

1. Clear Title: SQL Injection in Login Form
2. Description: What the issue is and why it matters
3. Target: Exact URL or IP (/login, /api/users/1)
4. CVSS Severity: With justification
5. Risk: What an attacker could achieve
6. Tools Used: Burp, Gobuster, Hydra...
7. References: CVEs, OWASP, etc.
8. Evidence: Payload, screenshot, server response
9. Remediation: Specific guidance (not just “patch it”)

Example Finding:#

### Vulnerability: SQL Injection
- Endpoint: POST /login
- Payload used:
    ' OR 1=1 --
- Tools: Burp Suite, sqlmap
- Impact: Complete authentication bypass
- Severity: CVSS 9.8 (Critical)
- Evidence: See /screenshots/sqli_login.png
- Recommendation: Use parameterized queries and input validation

Conclusion#

Once everything is documented, end with a clear conclusion:

• Is the system overall secure?
• What are the urgent actions?
• Is a retest required?

Example:#

Conclusion:
The test revealed several critical vulnerabilities. Immediate remediation is necessary. A follow-up test is recommended within 4–6 weeks after fixes are applied.