The Anatomy of a Pentest Finding
Pitfalls

Document your findings as you go!

The best time to capture the information required for a finding report is right when you find it! Some testers prefer to wait until post-engagement to fully document and flesh out their findings, but failing to document when it’s “fresh” can lead to the loss of information (because you forgot!) or loss of screenshots, recreation steps, or proof (because you don’t have access to the environment anymore or they changed something!). When it comes to documenting your findings, THERE’S NO TIME LIKE THE PRESENT.

Shoehorning

Hey, I’ll let you in on a little secret — IT’S OK TO SUBMIT A REPORT WITH ZERO FINDINGS. While you may think you “failed” or are providing an inferior product, you’re actually demonstrating the product is secure! So in that vein, don’t report a finding just because you think you don’t have enough. Informational findings, for example, are a tricky thing. It’s totally ok to tell the customer something you want them to know in other places in the report or outside of the reporting process itself, but if you can’t directly relate it to the security of the product, it’s NOT A FINDING. Don’t try to shoehorn a quasi-related thought into a finding just for the sake of having a finding.

Proofreading

Check your work before submitting to the customer or peer review! Review grammar, punctuation, and clarity. Doing it right the first time means less time in the review phase where people are wasting their time on something that should have been done right the first time.

Templatizing & Reuse

While it’s totally ok (and recommended) to reuse write ups of previous findings (or from findings databases like https://vulners.com), you should always make sure the information is directly applicable to this particular finding. Don’t just cut and paste word for word. Take the time to analyze a specific finding and provide your input. You have this job because you’re a trusted expert in the field. Additionally, you should avoid templatizing each part of your finding. (But it’s ok to templatize the entire finding by section.) For example, it’s not ok for all of your findings to read:

On — SITE–, a — TYPE — vulnerability was discovered. Recommend remediating this vulnerability in accordance with — Reference–

If your finding looks like it could be auto generated by a simple script, then what’s the point of having real humans do the work? The reason we’re here is to think. Analyze. Convince.
[]
['Infosec', 'Pentest', 'Report Writing', 'Vulnerability', 'Penetration Testing']