| name | reporting-pentest |
| description | Guides vulnerability report writing and finding documentation including severity rating, evidence standards, and report structure. Use during report phase (SG6) and when structuring harness evidence into client deliverables. |
Reporting Pentest
Prerequisites
- Evidence files live under
evidence/msf/ with engagement naming conventions.
- Complete
pentest-workflow SG6 subgates before final delivery.
- Redact credentials and PII before inclusion in reports.
Workflow
Task Progress:
- [ ] Collect findings with severity, impact, reproduction, remediation
- [ ] Link evidence files from evidence/msf/ to each finding
- [ ] Draft executive summary and severity summary
- [ ] Obfuscate secrets and PII in screenshots
- [ ] Export PDF (or Word via suzu-word MCP) for client delivery
Report structure
1. Title page (client, date, classification)
2. Executive summary (non-technical audience)
3. Scope and methodology
4. Summary of findings (severity table/chart)
5. Detailed findings (sorted by severity: Critical -> Info)
6. Remediation roadmap (prioritized)
7. Appendices (large PoCs, raw scan data, glossary)
Finding template
Each finding must include: Title, Severity/CVSS, Description, Impact, Reproduction steps, Remediation, Evidence.
| Rating | CVSS range | Criteria |
|---|
| Critical | 9.0-10.0 | Unauthenticated RCE, full domain compromise |
| High | 7.0-8.9 | Auth bypass, significant data exposure |
| Medium | 4.0-6.9 | Limited impact, requires user interaction |
| Low | 0.1-3.9 | Minor info disclosure, hard to exploit |
| Info | 0.0 | Best practice, no direct exploit |
CVSS calculation workflow
MSF: No direct module; use CLI/tools.
CLI fallback:
curl -s "https://www.first.org/cvss/calculator/3.1"
npm install -g cvss
cvss --base "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
python3 -c "from cvss import CVSS3; print(CVSS3('CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N').scores)"
Vector selection guide
| Metric | Common pentest values |
|---|
| AV (Attack Vector) | N=network, A=adjacent, L=local |
| AC (Attack Complexity) | L=low, H=high |
| PR (Privileges Required) | N=none, L=low, H=high |
| UI (User Interaction) | N=none, R=required |
| S (Scope) | U=unchanged, C=changed |
| C/I/A | N=none, L=low, H=high |
Example vectors:
- Unauthenticated RCE:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8)
- Auth SQLi data read:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5)
- CSRF state change:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (6.5)
Document vector string in each finding; map score to severity table above.
Evidence pull from MSF MCP
Vulnerabilities and notes
MSF MCP (preferred):
msf_vulnerability_info()
msf_note_info()
msf_host_info()
msf_service_info()
CLI fallback:
Review auto-saved hook output in evidence/msf/ and logs/ directories.
Credentials and loot (redact before report)
MSF MCP (preferred):
msf_credential_info()
msf_loot_info()
msf_list_active_sessions()
CLI fallback:
grep -r "engagement_id" evidence/msf/
ls -la evidence/msf/<engagement_id>/
Redact all passwords, hashes, tokens, and PII before inclusion. Use [REDACTED] placeholders.
Session and exploit evidence
MSF MCP (preferred):
msf_module_info(module_name="exploit/...")
msf_search_modules(query="<finding keyword>")
Reference MCP tool names and timestamps from evidence/msf/ auto-saved hook output in finding evidence sections.
Evidence standards
Screenshots
- Crop to relevant area; highlight key elements
- Include command in terminal screenshots
- Redact secrets with solid color overlay (do not blur)
PoC placement
- Small PoCs (single curl): inline in reproduction steps
- Large exploit scripts: appendix with reference in steps
- Never include live credentials
Writing quality
- Passive voice for findings
- Sort lists by severity
- Define acronyms on first use
Word document generation (suzu-word MCP)
MSF: No direct module; use suzu-word MCP.
CLI fallback (MCP via suzu-word):
create_report(title="...", client="...")
set_metadata(key="engagement_id", value="...")
add_executive_summary_table(...)
add_severity_summary_bar(...)
add_remediation_summary_bar(...)
add_finding(title="...", severity="High", cvss="7.5", impact="...", reproduction="...", remediation="...")
add_finding_group(name="Web Application", description="...")
insert_figure(path="evidence/msf/screenshot.png", caption="SQL injection PoC")
add_code_block(language="http", content="GET /api/users?id=1' OR '1'='1")
add_appendix(title="Raw Scan Results", content="...")
finalize_report()
render_report(template="...", output_path="deliverables/report.docx")
Map harness evidence paths into insert_figure and add_code_block. Export to PDF for client delivery.
Severity summary example
| Severity | Count |
|---|
| Critical | 1 |
| High | 3 |
| Medium | 5 |
| Low | 2 |
| Informational | 4 |
Remediation timeline: Critical/High within 30 days, Medium within 90 days.
Distribution
- Deliver PDF to client (not editable Word/Markdown)
- Password-protect PDF for sensitive engagements
- Do not send customer data to external LLM services
Related skills
pentest-workflow - SG6 report phase gates and subgatesmethodology-cheatsheets - cross-cutting operational references
