SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsreport-generate

report-generate

Security & auditing

View repository

Updated 10-16 09:59

About this skill

Penetration Testing Report Generation Methodology

The report is the final deliverable of a penetration test—no matter how impressive the attack, if the report is poorly written and the client cannot understand it, it is as good as not done.

Data Collection

First collect all existing data:

  • get_store_stats — Overall statistics
  • evidence_list(filter by type) — Asset inventory
  • list_vulns — Vulnerability list
  • evidence_list + evidence_read(filter by credential type) — Credentials (placed in the report after redaction)

Report Structure Template

1. Executive Summary (1 page, for management)

Summarize in non-technical language:

  • Assessment scope and timeframe
  • One-sentence conclusion: What the overall security posture is like (e.g., "3 critical vulnerabilities were found, and attackers can remotely gain full control of the server")
  • Key numbers: number of assets, number of vulnerabilities (distributed by severity)
  • Most urgent action items

2. Assessment Scope and Methodology

  • Target list (domains/IPs/applications)
  • Test type (black-box/gray-box/white-box)
  • Methodologies and tools used
  • Constraints (time, scope exclusions)

3. Findings Overview

Vulnerability statistics charts:

严重: ■■ 2
高危: ■■■ 3
中危: ■■■■■ 5
低危: ■■■ 3
信息: ■■■■■■ 6

4. Vulnerability Details (core section)

Describe each vulnerability using the following structure:

[Critical] SQL Injection — User Search Function

  • Location：https://target.com/search?q=
  • Description: The search parameter is directly concatenated into the SQL query without filtering, allowing attackers to read/modify/delete database contents
  • Impact: Can obtain all user data (including password hashes), can read server files
  • Reproduction Steps：
    1. Visit https://target.com/search?q=' OR 1=1--
    2. The page returns all records (normally only matching items should be returned)
    3. Use UNION SELECT to extract the users table
  • Remediation Recommendation: Use parameterized queries (Prepared Statement), and prohibit string concatenation in SQL

5. Risk Rating Standards

Use CVSS 3.1 or a simplified version:

Severity CVSS Typical Scenario
Critical 9.0-10.0 RCE, SQL injection that can obtain a shell, complete authentication bypass
High 7.0-8.9 Sensitive data leakage, privilege escalation, arbitrary file read
Medium 4.0-6.9 Stored XSS, CSRF, information leakage
Low 0.1-3.9 Reflected XSS, directory listing, version leakage
Informational 0 Security configuration recommendations, deviations from best practices

6. Remediation Recommendation Priority

Sort by remediation urgency:

  1. Fix immediately: Critical and high-risk vulnerabilities
  2. Planned fix: Medium-risk vulnerabilities (next version)
  3. Improve as appropriate: Low-risk and informational

7. Appendix

  • Tool list and versions
  • Detailed testing timeline
  • Raw scan data (optional)

Writing Principles

  • Reproducible: Technical staff can verify it themselves after reading the reproduction steps; a small PoC can be placed in the reproduction steps, while a longer PoC goes in the appendix and is referenced in the main text
  • Understandable: Management can understand the risk after reading the executive summary; the vulnerability impact must be tied to business consequences, not just technical terms
  • Actionable: Remediation recommendations must be specific down to the code/configuration level
  • Not exaggerated: Describe the risk objectively; do not raise the severity just to make it seem important
  • Deliverable: Prefer PDF for the final deliverable; do not use editable Word/Markdown/LaTeX as the only deliverable
  • Avoid subjective and emotional expressions; remain professional

Deliverable Quality Checklist

Sensitive Information Redaction

  • Irreversibly mask passwords, tokens, identity documents, personal photos, and customer data; avoid using only semi-transparent blur
  • Before importing screenshots into the document, complete the masking in the image file itself; do not rely on overlay shapes in Word, because the original image may still be stored inside the document package
  • For credentials, retain only the necessary prefix and suffix for locating them, for example AKIA...ABCD

Screenshot Standards

  • Screenshots should retain only the minimum area needed to prove the vulnerability, ensuring that commands, URLs, status codes, and key responses are readable
  • Avoid dark transparent terminals; reports are often printed or compressed, and low-contrast screenshots will lose fidelity
  • Add a title or caption to each image, and highlight the key evidence in the image
  • Command-line screenshots should include the actual command; screenshots of output alone are not conducive to reproduction

Document Hygiene

  • Lists should be deduplicated and sorted (by severity, domain, IP, port, or timeline)
  • Avoid vague quantities such as "multiple" or "some"; when it can be quantified, write the specific number
  • Do not send customer sensitive data to uncontrolled online LLMs; if writing assistance is needed, prioritize local models or redact first
  • Before delivery, check spelling, links, image clarity, table of contents, headers and footers, and whether attachments are complete