reporting-pentest

name	reporting-pentest
description	Guides vulnerability report writing and finding documentation including severity rating, evidence standards, and report structure. Use during report phase (SG6) and when structuring harness evidence into client deliverables.

Reporting Pentest

Prerequisites

• Evidence files live under evidence/msf/ with engagement naming conventions.
• Complete pentest-workflow SG6 subgates before final delivery.
• Redact credentials and PII before inclusion in reports.

Workflow

Task Progress:
- [ ] Collect findings with severity, impact, reproduction, remediation
- [ ] Link evidence files from evidence/msf/ to each finding
- [ ] Draft executive summary and severity summary
- [ ] Obfuscate secrets and PII in screenshots
- [ ] Export PDF (or Word via suzu-word MCP) for client delivery

Report structure

1. Title page (client, date, classification)
2. Executive summary (non-technical audience)
3. Scope and methodology
4. Summary of findings (severity table/chart)
5. Detailed findings (sorted by severity: Critical -> Info)
6. Remediation roadmap (prioritized)
7. Appendices (large PoCs, raw scan data, glossary)

Finding template

Each finding must include: Title, Severity/CVSS, Description, Impact, Reproduction steps, Remediation, Evidence.

Rating	CVSS range	Criteria
Critical	9.0-10.0	Unauthenticated RCE, full domain compromise
High	7.0-8.9	Auth bypass, significant data exposure
Medium	4.0-6.9	Limited impact, requires user interaction
Low	0.1-3.9	Minor info disclosure, hard to exploit
Info	0.0	Best practice, no direct exploit

CVSS calculation workflow

MSF: No direct module; use CLI/tools.

CLI fallback:

# CVSS v3.1 calculator (First.org API)
curl -s "https://www.first.org/cvss/calculator/3.1"  # use web UI for vector builder

# cvss-cli (npm)
npm install -g cvss
cvss --base "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
# Output: 9.8 Critical

# Python cvss library
python3 -c "from cvss import CVSS3; print(CVSS3('CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N').scores)"

Vector selection guide

Metric	Common pentest values
AV (Attack Vector)	N=network, A=adjacent, L=local
AC (Attack Complexity)	L=low, H=high
PR (Privileges Required)	N=none, L=low, H=high
UI (User Interaction)	N=none, R=required
S (Scope)	U=unchanged, C=changed
C/I/A	N=none, L=low, H=high

Example vectors:

• Unauthenticated RCE: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8)
• Auth SQLi data read: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5)
• CSRF state change: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (6.5)

Document vector string in each finding; map score to severity table above.

Evidence pull from MSF MCP

Vulnerabilities and notes

MSF MCP (preferred):

msf_vulnerability_info()
msf_note_info()
msf_host_info()
msf_service_info()

CLI fallback:

Review auto-saved hook output in evidence/msf/ and logs/ directories.

Credentials and loot (redact before report)

MSF MCP (preferred):

msf_credential_info()
msf_loot_info()
msf_list_active_sessions()

CLI fallback:

grep -r "engagement_id" evidence/msf/
ls -la evidence/msf/<engagement_id>/

Redact all passwords, hashes, tokens, and PII before inclusion. Use [REDACTED] placeholders.

Session and exploit evidence

MSF MCP (preferred):

msf_module_info(module_name="exploit/...")
msf_search_modules(query="<finding keyword>")

Reference MCP tool names and timestamps from evidence/msf/ auto-saved hook output in finding evidence sections.

Evidence standards

Screenshots

• Crop to relevant area; highlight key elements
• Include command in terminal screenshots
• Redact secrets with solid color overlay (do not blur)

PoC placement

• Small PoCs (single curl): inline in reproduction steps
• Large exploit scripts: appendix with reference in steps
• Never include live credentials

Writing quality

• Passive voice for findings
• Sort lists by severity
• Define acronyms on first use

Word document generation (suzu-word MCP)

MSF: No direct module; use suzu-word MCP.

CLI fallback (MCP via suzu-word):

create_report(title="...", client="...")
set_metadata(key="engagement_id", value="...")
add_executive_summary_table(...)
add_severity_summary_bar(...)
add_remediation_summary_bar(...)
add_finding(title="...", severity="High", cvss="7.5", impact="...", reproduction="...", remediation="...")
add_finding_group(name="Web Application", description="...")
insert_figure(path="evidence/msf/screenshot.png", caption="SQL injection PoC")
add_code_block(language="http", content="GET /api/users?id=1' OR '1'='1")
add_appendix(title="Raw Scan Results", content="...")
finalize_report()
render_report(template="...", output_path="deliverables/report.docx")

Map harness evidence paths into insert_figure and add_code_block. Export to PDF for client delivery.

Severity summary example

Severity	Count
Critical	1
High	3
Medium	5
Low	2
Informational	4

Remediation timeline: Critical/High within 30 days, Medium within 90 days.

Distribution

• Deliver PDF to client (not editable Word/Markdown)
• Password-protect PDF for sensitive engagements
• Do not send customer data to external LLM services

Related skills

• pentest-workflow - SG6 report phase gates and subgates
• methodology-cheatsheets - cross-cutting operational references