Professional Penetration Testing

CHAPTER 15. Reporting Results

Introduction

Не то забота что многа работы, а то как ее нет. – Russian proverb: “No work is worse than overwork.”

(Mertvago, 1995)

Finding vulnerabilities and exploits on a target is a lot of fun – writing up the findings … not so much. Although the customers have paid for a penetration test, what they really want is the final report, which outlines what is wrong and how it needs to be fixed. The customer doesn't get excited when the penetration test engineer finally obtains a root shell account at 3:00 a.m. on a Saturday morning after spending all day figuring out what offset is needed to make a buffer overflow work. The customers gets excited when they receive a report that goes beyond their expectation in detailing ...