Chapter 7 - Wrapping Up the Penetration Test

Abstract

The writing of a penetration testing report is one of the most critical tasks performed by an ethical hacker. Many penetration testers often collect and neatly organize the various outputs into a single report. They gather any pertinent information from the reconnaissance phase and include it along with the output from Nmap and Nessus. An effective penetration testing report should include an executive summary, a detailed report, and raw output. The executive summary should be a very brief overview of the major findings. This document, or subreport, should not exceed two pages in length and only include the highlights of the penetration test. The executive summary does not provide technical details or terminology. The detailed report includes a comprehensive list of the findings as well as the technical details. The audience for this report includes IT managers, security experts, network administrators, and others who possess the skills and knowledge required reading and comprehending its technical nature. The final portion of the report should be the technical details and raw output from each of the tools. In reality, not every penetration tester will agree that this information needs to be included with the penetration testing report.