How to write a pentest report

A few month ago i passed the eWPT exam. That is when i realized that doing a pentest report could be hard for people who just broke in to the industry.

This article will try to give some simple steps on how to write a pentest report and important elements that should be in it. It aims to give professionals new to the field some advices on how to write a report for exams or for customers. It can also be used by bug hunters (the vulnerability report part).

This article is small on purpose, i want it to be clear but not too tenuous to read as the process of writing a report can seem scary to newcomers.

Why do we need a report?

A report is the document that will present all your findings and explain to every role of the company you’ve been hired by for the mandate. It will contain the scope previously defined with your customer, high level explainations of the findings and their impact as well as precise technical descriptions of every finding. There are different parts in a report.

The Executive Summary

This is the part where you need to explain for the executive of the company who will read the report. It needs to be high level explainations with no technical details.

It is relevant to add graphs of the findings such as: Vulnerabilities by impact, Attacks by type and Vulnerabilities by cause.

The definitions on Mitre CWE can help you for defining the categories to use in those graphs.

It can comport a global posture on how the findings and attack combinaison could impact your customer’s business.
It can be also useful to include a remediation priority based on your expertise and the prior discussions you had with your customer.

The Vulnerability Report

This is the part where you present each vulnerability you found. I recommend that you order those by severity.

Each vulnerability should have a score that you can calculate using CVSS scores. Here is a calculator. This score takes in account precise metrics to generate a score as close as possible to the impact the vulnerability could have. However, depending on the context of your customer the impact might not be the same, this will be your expertise and the prior conversation that you had with your customer about their business that will help you define the impact for your customer. You don’t need to tamper the CVSS metrics, this is the goal of the remediation priority i mentioned in the previous part.

Here is a way to present it:

  • Severity
  • CVSS score
  • Affected item
  • Description: you have to explain the vulnerability and explain it in the context of your target. For example: « In the context of the support page, some checks were made on the client side, but those checks could be bypassed. »
    Feel free to add resources about the vulnerability
  • Remediation: Here you have to explain how to mitigate the vulnerability. It is always good to add resources from recognized industry standards like OWASP for web pentesting reports.
  • Evidence: Here you need to add proof of the vulnerability. The goal is that the team that will implement the mitigation is able to reproduce the attack. That is why it is important that during the attacking phase you write plenty of notes and take plenty of screens and proofs.

Note: I personaly prefer when each vulnerabilty is presented with the remediation but you can also write a remediation report part right after this.

Useful Resources

Here is a great template done by Andrew Morrison (docx and odt):

  • Pentext is a collection of XML templates, XML schemas and XSLT code, which combined provide an easy way to generate IT security documents including test reports
  • Pentest standards about reporting
  • Radically Open Security provides in their portfolio some reports of project they did. Thoses are good examples.
  • MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.
  • CWE is a community-developed list of software and hardware weakness types. It serves as a common language, a measuring stick for security tools, and as a baseline for weakness identification, mitigation, and prevention efforts.
  • OWASP list of vulnerabilities (for web pentesting)
  • Exploit db is a great resource for exploitation
  • National Vulnerability Database by the US CERT

How to get started with pentesting?

When people ask me about how to get into pentesting, the first i say is that practice is essential. But how to practice pentesting on your own? How to get started with virtual machines?

In this article i am going to explain, how to create a virtual attacking machine. With this machine, you will be able to practice on platforms that have « boxes ». Boxes are vulnerable machines that can be hacked. I will then present some of the website you can use for practice.

Practicing this way is very helpful because it is the closest way to understand pentest (it is not realistic but you will get the core techniques used for pentest)

How to get started ?

Create your virtual attacking machine with Kali Linux

  1. Download Virtualbox and install it: https://www.virtualbox.org/  
  2. Download Virtualbox and install it from here  
  3. Download the lastest kali linux virtualbox image (it is going to be our attacker machine) Make sure to take the virtualbox image and not the vmware one:
  1. Install Kali:
  • Go to virtualbox and click on « File » > « Import Appliance… »
  • Click on the yellow folder and navigate to the image of kali you downloaded, select it and click on open
  • Click on next and then click on import. It will take a little while… And then launch it for the first time. Username should be kali and password kali but you can find this info on their website or on the description of your machine in virtualbox
A screenshot of a social media post

Description generated with very high confidence

What website can you use?

Some great starters

First i would recommend to create an account on tryHackMe here, it’s free! Then you will have to download your configuration file and access to the VPN so you can start hacking away on their machines.

What is awesome about tryhackme is that you even have box to learn how to get started on their platform here. This other box will tell you everything about OpenVPN and how to access the boxes. So it will not only be useful on tryhackme but also on other platforms and in your daily practice as a pentester (we do sometimes need a VPN to access our customer system to test).

If you are not familiar with VPN here is a wikipedia article explaining what it is. But simply put you can see a VPN as a tool that will give you access to another computer or environment remotely. TryHackMe and other website for pentesting practice will require a VPN so that you can access your practicing environment, usually a vulnerable machine hack.

If you are not familiar with linux, TryHackMe has a box that explains it very well, you even get a cool badge by completing it! You can also practice on overthewire.org, this website is a wargame you will be able to learn about linux and security concepts. If you want a little more explainations on concepts you should definitely go on linuxjourney.

After this you can have a look at the box on TryHackMe that introduces you to pentesting: basic pentesting.

Here is a list of great box (all free) on tryhackmefor beginners:

There are plenty more i really recommend you to have a look around.

Push your skills further with other platforms

You have covered your beginners skills? You want to go further? Here are some useful resources for this.

CSNP – What is pentesting?

CyberSecurity NonProfit (CSNP) is a 501(c)(3) nonprofit organization that provides free security education and resources to make cybersecurity more accessible, inclusive, and diverse.

I was invited to talk and i discussed what pentesters do, what skills are needed, and how to start a career in pentesting. I also demonstrated web application exploits such as SQL injection and cross-site scripting (XSS).

A toi belle journée d’hiver * Okiok

Ma démarche d’auto-formation en cybersécurité que je documente ici, depuis avril 2018, m’a permis d’être embauchée comme pentesteuse chez Okiok.

Cette nouvelle aventure canadienne m’a inspiré un conte cyber.

Il était une fois, un grand grand royaume nommé l’Internet où existe un territoire lointain et invisible, le Cyberespace.

Cet espace non défini, renferme les plus grands serpents de mer du royaume. Ces colosses, cachés sous nos océans terrestres sussurrent les tous petits, les petits, les moyens, les grands et les très grands secrets de ses habitants que l’on appelle : Internautes. 

Ces Internautes, habillés de rouge, de bleu, de violet, de noir ou d’autres couleurs encore ont chacun une façon bien particulière de vivre dans le royaume. 

Les bleus défendent le royaume, les rouges préparent les bleus en organisant de fausses attaques qui consistent à attraper discrètement des drapeaux sur les territoires à défendre. Les violets font les deux et enfin les gris-noirs ont des projets bien plus flous. 

Ces derniers portent différentes nuances de noir. Ils ont pour emblème un hoodie de leur couleur qui cache leurs yeux. 

Certains d’entre eux militent pour des causes politiques ou sociales nobles ou pas, d’autres s’accaparent les richesses du royaume et des Internautes et d’autres encore, créent des stratégies d’intrusions qui pourraient détruire le royaume et ses habitants.

Face à tous ces personnages aux bonnes et mauvaises intentions, j’ai voulu m’impliquer avec ceux vêtus de couleurs claires et dont les yeux étaient teintés d’une lueur bienveillante. 

C’est alors que j’appris qu’au coin de ma rue, Okiok, le premier à avoir voulu protéger l’Internet et ses habitants organisait un recrutement d’internautes aux couleurs claires. 

D’un pas curieux et décidé, je suis allée à sa rencontre, car je voulais faire partie de son équipe. 

C’est ainsi que nous avons discuté, de mes voyages dans le royaume, de ses missions pour qu’il reste sûr et libre et qu’il m’a invité à attraper des drapeaux pour un premier essai.

Quelques jours plus tard j’appris avec une grande joie que j’allais faire partie de son équipe. Surexcitée, je m’empressais de le rejoindre dans son pays d’hiver où il m’a accueilli chaleureusement par un « Bienvenue dans la famille ». 

J’avais enfin trouvé la définition de la cybersécurité : confiance et bienveillance.

My internship at Radically Open Security

One of my goal in this ethical hacker challenge was to volunteer for a GREAT organization. This is what I did with Radically Open Security who welcomed me as an intern for six months.

Where did I get this opportunity?

When I started to work in the IT I quickly had concerns about the lack of safety on the Internet. Therefore, my curiosity and thirst for learning led me to wonder about the construction of a safer cyberspace. This quest has shaped the type of company I wanted to be involved with. This is when I discovered the existence of ROS (Amsterdam, Netherlands) and Melanie Rieback in a press article. This initiative was an evidence and in line with the values I want to promote. Transparency is the central point of this company and its business model is a promise of a better social future.

What is Radically Open Security?

« Radically Open Security is the world’s first not-for-profit computer security consultancy company. We are prototyping an innovative new business model – using a Dutch « Fiscaal Fondswervende Instelling » (Fiscal Fundraising Institution) to provide a commercial front-end that sends 90% of our profits tax-free to a backend foundation (Stichting NLnet) that has supported open-source, Internet research, and digital rights organizations for almost 20 years. The other 10% of our profits will go to an employee profit-sharing scheme, in which the secretary accumulates profit-sharing rights as quickly as the CEO. Additionally, due to our low management/overhead costs, we can afford to pay competitive wages to our computer security consultants.  »
At ROS everybody works remotely.
(source: https://radicallyopensecurity.com/business-model.htm)

Wait! Not for profit?

Yes not for profit! Let Melanie Rieback co-founder and CEO explain this to you:

What service do they offer?

  • Penetration testing, ethical hacks and social engineering
  • Malware reversing and analysis
  • Network monitoring and threat detection
  • Forensics
  • CSIRT and incident response
  • Code audits
  • DDoS Testing
  • Cryptographic analysis
  • Custom R&D Projects
  • Workshops, trainings and mentoring
  • Misc: Embedded, Android and RFID Security

(source: https://radicallyopensecurity.com/services.htm)

What did i do?

Participation in the creation of a Capture-The-Flag (CTF) game

ROS helped to build a CTF for the CyberHeroes week of the non profit organization Cyberworkplace (see my article about the CyberHeroes week here).
The theme of the week was Heroes in cyber, I build a list with many heroes from the cybersecurity world, cryptography and cybersecurity resources.

Observation of pentests

I was added to some pentesting channels on RocketChat a chatroom that was used for communication for work purposes. This way, i was able to peek over the shoulders of pentester and see how they work, how they communicate with the client as the pentests are completely available to the clients from the begining to the end (this is one of the core principle of ROS).

Review of pentest reports

I was able to read and review some pentests reports. This really helped me to see how proper pentest reports are build, what pentesters look for while pentesting and which tools they use.

Improvement of the onboarding manual for new staff members

When i onboarded i was provided with an onboarding manual. As i encountered some little problems to set up my work environment i added some entrees in the onboarding manual in order to help future onboarders who had the same configuration i had.

Creation of a wiki page with relevant onboarding information for new staff members

ROS wanted to improve the onboarding process and provide the onboarders resources and useful informations.
This is why i created a wiki page with many resources for every type of positions (project management, software development, pentesting, …). I also added a section for general informations about ROS.
After the set up of this wiki i invited everyone to contribute and share their knowledge with relevant links like their favorite tools that help them in their tasks, great articles they’ve read, anything they would find relevant.

Submission of a process for improving internal training

We wanted to improve the internal training that is why i created a documentation to propose some ideas on the subject.

Helping a coworker with the use of Gitlabs (Radically Open Security’s file storage system)

One of the other intern was new to Gitlabs. As i had previously encountered Git and worked with it, i was able to provide my help.

Organizing folders in Gitlabs

ROS puts their projects and documentation on an internal Gitlabs system. I updated the organization of the folders.

Use of Pentext and XML

« The OWASP PenText XML documentation project can help your software security company produce offers, reports, invoices and generic documents by offering a well-structured and easy to maintain documenting system you can modify to your liking. »
This tool was created by ROS they open sourced it and made it available on Github.
In order to use Pentext you need to know XML.
I really enjoyed using pentext. XML is really useful and you get to generate great looking documents. This saves a lot of work mainly for pentesting reports but it can also be use to save time on other types of reports.

What did I gain from this experience

As I plan to build a company, ROS was an inspiring and innovative model for tomorrow’s companies.
More specifically, I learned how a holocratic system works in a company. This system in which everyone has a place and a voice has been a beautiful discovery.
On a more technical aspect I have used many tools such as Pentext.
Finally, I have appreciated working remotely because it requires a personal work organization that invites to be autonomous and rigorous.

(source cyberheroes week flickr) During the CyberHeroes week i had the opportunity to meet Daan, Steven, Melanie and Anh from ROS.

To go further

Engensec IT Security Summer School

(Article disponible en français plus bas)

To move forward in my challenge, I decided to attend a Summer School. That is how in july, i had the great opportunity to attend a European Program in Cybersecurity in the beautiful city of Lviv (Ukraine).
This program was held by the Lviv National Polytechnic University and the classes were organised in a beautiful annexe of the University.
view from the outside
entrance hall
corridor
Many students from different countries were attending this studious week: Ukraine, Sweden, Poland, Netherland, Luxembourg and France.

Presentation of the IT Security Summer School in the Lviv National Polytechnic University.

Why a Summer School ?

Well, a Summer School is a short and intensive way to gain skills quickly plus you get to meet people from all over the world.
Also, it seemed important to me to confront my knowledge with practical exercises in group to give an interactive dimension to my learning in self-training. Finally, being coached by cybersecurity experts during the summer school allowed me to consolidate the knowledge acquired during the previous months.

What did we learn ?

On the first day, we had a first assignment which was fun. We were given a list of teams named after malware. The goal was to find our team mates with the help of this list. It was a very good ice breaker to first meet attendees. To go further with the social interactions we also had a team quest to do in order to get to know each other better and discover the city.

The high quality courses were taught by professors from leading European universities such as Sweden, Poland and Ukraine.

The four main subjects discussed during the week

Malware Analysis

First, the history of ransomwares (first ransomware: AIDS trojan 1989) was discussed.
Then we reviewed different ransomwares: their encryption method, how they interact with the user and for some of them how to decrypt files.
The practical exercises allowed me to understand the necessary steps to analyze malware.
However, there is no single way or infallible method. This field requires great patience and perseverance to gain more experience.

Software Security

This course was about : Programming problems and buffer overflows, Defensive programming, Revision control systems and Good practices.

About the part « good practices », i wish i had such a course during my training as a programmer. Good practices in development for security is, in my opinion, a must known for every developer.

The lab about buffers was really helpful to better understand the buffer overflow error and how it can make a software very vulnerable. I had another Lab in which i had to manipulate and debug a program in order to find a password.

Web Security (including web app vulnerabilities)

Web security is quite an important piece in cybersecurity.
This class gave me an overview of the most common vulnerabilities on the web. With this course I was able to complete my list of tools and Websites related to Web security.

I really enjoyed the practical exercises because they were divided into several stages and allowed me to progress naturally according to the level of difficulty. More precisely during these exercises I tested the vulnerabilities during authentication, SQL injection, XSS vulnerabilities and ethical hacking.

Pentesting

This course gave a good overview of the duties of the pentester.
First we discussed several elements such as technical terms, the different types of hacker, pentesting tools and methodologies.
We also worked on the methodology to follow when writing a pentesting report.
Also, I learned the techniques of malicious hackers in order to propose a good defense strategy.

Finally, all the practical exercises allowed me to get use to the tools used during pentests, analyze vulnerabilities, test web applications and put social engineering methods into practice.

A step in the workforce

At the end of the fourth day two professionals came to share their experiences in the Security Operation Center of a Ukrainian business. They described their work and the issues they had to tackle every day.

This presentation gave us an inside point view of cybersecurity professionnals.

A place of culture and full of history

The City of Lviv

Lviv is a city in western Ukraine which was founded in the 13th century but has roots since the 6th century. Needless to say it is full of history.

Opéra House of Lviv Opera House of Lviv

You’ll have many opportunies to widen your culture:

  • Go to the Opera and see a beautiful piece
  • Visit beautiful churches
  • Just walk around in the streets of the old town
  • Eat and discover local gastronomy

The city tour

Engensec organized for us an amazing city tour with historic reconstitution and actors in costums in many corners of the city.
It was very a good break from the classes and a good entertainment.
sword fight
guided tour

Why you should attend Engensec?

– The organizers are very welcoming and helpful
– You get to have social interactions with people from all over the world
– If you want high quality classes for a great value this is totally the place to go
– You get a certification in the end of the week and ECTS for a total of 60 hours
certificate example

To go further


Pour avancer dans mon défi, j’ai décidé de suivre une summer school. C’est ainsi qu’en juillet, j’ai eu l’opportunité d’assister à un programme européen de cybersécurité dans la belle ville de Lviv (Ukraine).
Ce programme a été organisé par l’Université Polytechnique Nationale de Lviv et les cours avaient lieu dans une magnifique annexe de l’Université.

view from the outside
entrance hall
corridor

De nombreux étudiants de différents pays participaient à cette semaine studieuse : Ukraine, Suède, Pologne, Pays-Bas, Luxembourg et France.

Présentation de Engensec security summer school à l’Université polytechnique nationale de Lviv.

Pourquoi une summer school ?

Une summer school est un moyen court et intensif d’acquérir rapidement des compétences et de rencontrer des gens du monde entier. Aussi, il m’a semblé important de confronter mes connaissances à des travaux pratiques en groupe pour donner une dimension interactive à mon apprentissage en auto-formation. Enfin, être accompagné par des experts en cybersécurité pendant la summer school, m’a permis de consolider les connaissances acquises durant les mois précédents.

Qu’avons-nous appris ?

Le premier jour, nous avons eu un premier exercice assez amusant. On nous a donné une liste d’équipes portant le nom d’un logiciel malveillant. Le but était de trouver nos coéquipiers à l’aide de cette liste. C’était une très bonne façon de briser la glace. Pour aller plus loin dans les interactions sociales, nous avions aussi une quête à faire en équipe pour mieux se connaître et découvrir la ville.

Les cours de qualité étaient encadrés par des professeurs de grandes universités européennes telles que la Suède, la Pologne et l’Ukraine.

Les matières abordées dans la semaine

Malware Analysis

Dans ce module nous avons abordés l’historique des ransomwares (premier ransomware: AIDS trojan 1989).
Ensuite nous avons passé en revue différents ransomwares: leur méthode d’encryption, la façon dont ils se manifestent pour l’utilisateur et pour certains comment décrypter les fichiers.

Les exercices pratiques m’ont permis de comprendre les étapes nécessaires pour analyser un malware.
Pour autant, il n’existe pas une seule façon de faire ni une méthode infaillible. Ce domaine implique une grande patience et persévérance pour laisser place aux tâtonnements et à l’expérience.

Sécurité des logiciels

Dans ce cours nous avons abordé : les erreurs de programmation dont le buffer overflow, la programmation défensive, les systèmes de contrôle de révision et les bonnes pratiques en programmation.

En ce qui concerne la partie « bonnes pratiques », j’aurais aimé avoir un cours comme celui ci lors de ma formation de développeuse. Selon moi, il est indispensable de connaître ces bonnes pratiques afin d’être en mesure de livrer des logiciels sécurisés.

L’exercice pratique sur les buffer a été vraiment utile pour comprendre comment l’erreur buffer overflow peut rendre un logiciel très vulnérable. Dans un autre exercice, il fallait manipuler et débugger un programme afin de trouver un mot de passe.

Sécurité Web (dont vulnérabilités des applications Web)

La sécurité Web est un élément essentiel de la cybersécurité. Ce cours donne un aperçu des vulnérabilités les plus courantes sur le web.
Aussi grâce à ce cours j’ai pu compléter ma liste d’outils et de sites Web relatifs à la sécurité du Web.

J’ai beaucoup apprécié les exercices pratiques car ils étaient découpés en plusieurs étapes et permettaient de progresser naturellement en fonction du niveau de difficulté. Plus précisément lors de ces exercices j’ai testé les vulnérabilités lors d’authentification, l’injection SQL, les faille XSS et le hacking éthique.

Pentesting

Ce cours donnait un bon aperçu des missions qui incombent au pentester.
Tout d’abord nous avons abordé plusieurs éléments comme les termes techniques, les définitions des profils de hackers, les outils et les méthodologies du pentesting.
Nous avons également travaillé sur la méthodologie à respecter pour la rédaction d’un rapport de pentesting.
Aussi, j’ai pris connaissances des techniques de pirates malveillants afin de proposer une bonne stratégie de défense.

Enfin, tous les exercices pratiques m’ont permis de me familiariser avec les outils utilisés lors des pentests, d’analyser des vulnérabilités, de tester des applications web et de mettre en pratique des méthodes de social engineering.

Un aperçu des opportunités d’emploi

A la fin de la quatrième journée, deux professionnels sont venus partager leur expérience dans le Security Operation Center d’une entreprise ukrainienne. Ils ont décrit leur travail et les problèmes auxquels ils étaient confrontés au quotidien.

Cette présentation était intéressante pour avoir un point de vue de professionnels de la cybersécurité.

Un lieu de culture et plein d’histoire

La ville de Lviv

Lviv est une ville de l’ouest de l’Ukraine qui a été fondée au 13ème siècle mais qui a des racines depuis le 6ème siècle. C’est donc une ville pleine d’histoire.
Opéra House of Lviv Opera de Lviv

Ainsi, vous aurez de nombreuses occasions d’élargir votre culture :

  • Aller à l’Opéra et voir une belle pièce
  • Visiter de belles églises
  • Marcher dans les rues de la vieille ville
  • Découvrir la gastronomie locale

La visite de la ville

Engensec a organisé pour nous une visite avec une reconstitution historique faite par des acteurs en costumes dans de nombreux coins de la ville.
C’était une très bonne pause des cours et un bon divertissement.
sword fight
guided tour

Pourquoi vous devriez venir à Engensec?

– Les organisateurs sont très accueillants et serviables.
– Vous aurez des interactions sociales avec des gens du monde entier.
– Si vous voulez des cours de haute qualité pour un prix abordable, c’est l’endroit idéal.
– Vous obtenez une certification en fin de semaine et des ECTS pour un total de 60 heures.
– Le programme est ouvert à tous sans condition de niveau ou d’âge.

certificate example

Pour aller plus loin