Expert · Post-exploitation ethics and reporting · topic 30 of 35 · 20 min
The structure of a penetration test report
Explanation
Two readers, one report
Your report will be read by two very different people. A manager or business owner wants to know, in plain language, how bad things are and what to do first. A developer or administrator wants exact detail to reproduce and fix each issue. A good report serves both, usually by starting with a short executive summary and following with detailed findings.
The usual sections
- Executive summary: plain-language overview of the risk and the top priorities, for non-technical readers.
- Scope and methodology: what was tested, when, and how (so the test can be understood and repeated).
- Findings: each vulnerability with a severity, description, evidence, impact and remediation.
- Overall risk and recommendations: themes and the most important next steps.
- Appendices: tool output, detailed steps, and references.
What a single finding contains
| Part | What it says |
|---|---|
| Title | A short, clear name (e.g. "SQL injection in login") |
| Severity | A CVSS score and band (Critical/High/…) |
| Description | What the flaw is, in plain words |
| Evidence | A screenshot or request/response proving it (minimal, no real data) |
| Impact | What an attacker could do, and which CIA goal it threatens |
| Remediation | The concrete fix, with a reference (e.g. OWASP cheat sheet) |
Prioritise so the client can act
A list of 30 findings with no order is overwhelming. Sort by severity so the client fixes the critical issues first. In the executive summary, name the few that matter most. The aim is not to show how clever you are; it is to help a busy team reduce risk quickly with limited time.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
The structure of a penetration test report · 1/7
A report serves two readers: managers (big picture) and technical staff (detail).
Prefer a video by a teacher? Find free videos on “how to write a penetration testing report structure findings” on YouTube ↗
In real life: The summary the CEO reads
A tester opens her report with a half-page executive summary: "Three critical issues let an outside attacker read customer data. These should be fixed this week. Seven lower issues can follow." The CEO understands the risk in a minute and approves the work. The developers turn to the detailed findings, each with a CVSS score, a minimal screenshot and a clear fix. One report served both readers because it was structured for them.
Practice (0/3 done)
The executive summary is written for…
Findings should be sorted by…
Write a single finding for a lab SQL injection in the login, using the six parts (title, severity, description, evidence, impact, remediation).
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Writing findings that get fixedPost-exploitation ethics and reporting · same module
- The law in India: IT Act 2000, sections 43 and 66Rules first: ethics, law and permission
- Full-stack interviews in IndiaFull-Stack Development · Capstone, portfolio and getting work
- Vulnerability scanners: OpenVAS and Nessus (concepts)Enumeration and vulnerability assessment
- Building a portfolio and getting hiredBug bounties, disclosure and careers
- What ethical hacking is (and is not)Rules first: ethics, law and permission
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
A good remediation line is…
Answer: "Use a parameterised query (see OWASP cheat sheet)"
Concrete, referenced fixes are actionable.
Evidence in a finding should be…
Answer: Minimal proof with no real sensitive data
Minimal proof respects the client and the law.
Scope and methodology are included so that…
Answer: The test can be understood and repeated
They make the test transparent and repeatable.
A pentest report should be…
Answer: Stored and shared securely with agreed people only
It details weaknesses, so it must be protected.
Before reporting a finding you should…Related
Answer: Confirm it is real and the severity fits the context
Verify to avoid false positives and overstatement.
A critical CVSS score always means…Related
Answer: It is severe, but you still judge the real risk in context
Severity is high, but reachability and mitigations change the real risk.
Which phase is the most valuable to the client?Related
Answer: Reporting
A clear report with risks and fixes is what the client pays for.
Section 43 of the IT Act is best described as…Related
Answer: A civil liability to pay compensation for unauthorised access/damage
Section 43 is civil: compensation for access or damage done without permission.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 1 more topic in “Post-exploitation ethics and reporting” before its exam: Writing findings that get fixed.
- Module 9 exam: ethics and reporting · 12 questions · 20 min, without help. 3 topics of this module still to finish first.
- Then the next module, Bug bounties, disclosure and careers. 35 topics left in the course before the final exam.
← Previous: Post-exploitation ethics: what to do once you are in