pentest-reporting

Pentest Reporting & Evidence Management

Supplementary Files:

• payloads.md — Command reference covering Dradis, Faraday, pipal, cutycapt, recordmydesktop, magictree, and cherrytree
• test-cases.md — Structured test case list covering report generation, evidence capture, password analysis, and data management

Summary

Pentest Reporting skill domain covering reporting operations.

Tools: dradis, faraday, pipal, cutycapt, recordmydesktop, magictree, cherrytree, Evidence Integrity (+11 more)

Domain: reporting

Use Cases

1. Collaborative Report Authoring — Use Dradis to centralize findings from multiple testers, attach evidence, and generate client-ready reports with consistent formatting
2. Vulnerability Management Platform — Import scan results from Nmap, Nessus, Burp, and other tools into Faraday for correlation, deduplication, and multi-project tracking
3. Automated Evidence Capture — Capture browser-based screenshots with cutycapt and record desktop sessions with recordmydesktop for reproducible, timestamped evidence chains
4. Password Audit Reporting — Analyze cracked password lists with pipal to identify patterns, generate statistics, and produce actionable remediation recommendations
5. Structured Data Organization — Use cherrytree and magictree to organize findings, attack trees, credentials, and notes in hierarchical, searchable structures
6. Client Deliverable Generation — Combine evidence from multiple sources into a polished final report with severity ratings, remediation steps, and compliance mapping

Core Tools

Methodology

Reporting Workflow

Evidence Collection     Findings Correlation     Report Authoring        Deliverable Generation
(Screenshots/Video/     (Faraday Import/         (Dradis/Magictree/      (PDF/DOCX/HTML Export
 Notes/Passwords)        Dedup/Priority)          Templates)              with Sanitization)
       |                      |                       |                        |
       v                      v                       v                        v
                Quality Review and Peer Validation
                (Sanitization/Formatting/Accuracy)

Phase Details:

1. Evidence Collection — Capture screenshots with cutycapt for web-based findings, record video demonstrations with recordmydesktop for complex exploit chains, and document all observations with timestamps in cherrytree
2. Findings Correlation — Import results from all scanning and exploitation tools into Faraday for automatic deduplication, severity normalization, and host-based correlation. Use magictree for structured attack tree documentation
3. Report Authoring — Use Dradis to compose findings with evidence attachments, assign severity ratings with CVSS scores, and apply report templates that match the client's expected format
4. Deliverable Generation — Export reports in multiple formats (PDF, DOCX, HTML), apply sanitization to remove real IPs and credentials, and generate password audit statistics with pipal for credential-related findings

Defense Perspective

Practical Steps

Step 1: Set Up Reporting Infrastructure

Initialize Dradis for collaborative report authoring and Faraday for vulnerability correlation before testing begins. Configure project structures and import templates.

Step 2: Capture Evidence During Testing

Use cutycapt for automated web screenshots, recordmydesktop for exploit demonstrations, and cherrytree for real-time note-taking. Maintain consistent naming conventions for all evidence files.

Step 3: Correlate and Deduplicate Findings

Import all tool outputs into Faraday for automatic deduplication and host correlation. Use magictree to build structured attack trees that show the relationship between findings.

Step 4: Analyze Password Audits

Run pipal against cracked password lists to identify patterns (common bases, complexity distribution, top passwords). Include results in the deliverable with remediation recommendations.

Step 5: Generate and Deliver Report

Compose the final report in Dradis, attach all evidence, apply sanitization, and export in the client's preferred format.

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Detection Methods

Report Quality Metrics

• CVSS accuracy: Reported CVSS matches calculated CVSS v3.1/v4.0.
• Remediation verification: All "fixed" findings verified by re-test.
• False positive rate: <5% of reported findings are false positives.

SIEM Detection Rules

• Custom tracking: Jira / GitHub Issues integration for finding lifecycle.

Defense Evasion Techniques

Operational Security for Testers

• Stay in scope: Don't access systems outside engagement letter; preserves legal protection.
• Document everything: Maintain detailed audit trail; demonstrates authorization.
• Notify client of high-risk findings immediately: Don't wait for final report for critical issues.

Report Quality

• Verify findings: Independent reproduction before reporting.
• Provide actionable remediation: Don't just identify problems; suggest concrete fixes.
• Map to MITRE ATT&CK: Use standardized framework for cross-org understanding.

Common Pitfalls

• Delaying evidence capture: Trying to reproduce findings after the engagement ends often fails because environments change or are patched. Capture screenshots, video, and notes in real-time during testing — every finding should have evidence attached within minutes of discovery.
• Skipping deduplication: Running multiple scanners without correlating results produces inflated finding counts that erode client trust. Always import into Faraday or a similar platform to merge duplicates before including in the report.
• Inconsistent severity ratings: Different team members applying different severity criteria for similar findings undermines report credibility. Establish a CVSS-based rubric at the start of the engagement and cross-validate all ratings.
• Poor password audit reporting: Simply listing cracked passwords without pattern analysis provides no actionable guidance. Use pipal to identify systemic weaknesses (common bases, missing complexity rules) that drive remediation policy changes.

Automation and Scripting

Automate the reporting pipeline by chaining Faraday's API for findings import and deduplication, then pushing correlated results to Dradis via its REST API for report generation. Use cutycapt in batch mode to screenshot every confirmed vulnerable endpoint, and wrap pipal in a script that generates both raw statistics and executive-friendly summary charts. Cherrytree's XML storage format enables programmatic extraction of structured notes for integration into the final deliverable.

Integration with Other Skills

Pentest reporting sits at the end of every engagement workflow. Network pentest and web application testing skills feed their raw outputs into Faraday. The article-writing skill provides the report structure templates and writing methodology, while pentest-reporting supplies the tooling for evidence management, findings correlation, and collaborative authoring. Post-exploitation and privilege escalation findings require particularly detailed evidence chains that cutycapt and recordmydesktop provide.

Tool Comparison Matrix

Learning Resources

This skill's supplementary files: payloads.md, test-cases.md

Related skills:

• skills/article-writing/SKILL.md - Report writing methodology and templates
• skills/engagement-manager/SKILL.md - Engagement scoping and deliverable management
• skills/password-attack/SKILL.md - Password cracking tools that feed pipal analysis

Guides in this skill:

• guides/dradis-faraday-reporting.md - Dradis and Faraday reporting workflows
• guides/evidence-collection.md - Evidence capture and chain of custody
• guides/password-audit-reporting.md - Password audit analysis and reporting