Practice — write a professional pentest report from lab findings — Offensive Security & Penetration Testing

What You'll Build

In this exercise you will transform a set of lab findings into a complete, professional penetration test report serving both executives and engineers. You will write a clear executive summary of business risk and priorities, document technical findings with severity, reproduction, evidence, and remediation, apply CVSS with business context to prioritize, and assemble it all into a coherent deliverable. This is the capstone reporting skill: turning raw discoveries into a document that actually drives an organization to fix its weaknesses.

Analogy🏏Cricket

🎬 Think of it like movies: Producing a film means running every department, scouting, shooting, editing, sound, then delivering one coherent final cut a distributor can actually screen, not a pile of loose reels. Just as the producer is judged by that single assembled cut, this exercise judges you by one consolidated, prioritized inventory drawn from passive discovery, active scanning, enumeration, and vulnerability triage. Just as no scene is shot without the studio's sign-off, none of this runs outside your authorized lab range. This reveals the recon sweep as delivering the final cut, not a heap of unassembled footage.

Prerequisites

The two-audience reporting structure from Lesson 28, an executive summary plus detailed technical findings, and why each audience needs different content.
CVSS scoring and context-aware prioritisation from Lesson 29, to rank fixes by real risk rather than raw score.
The ethical reporting obligation from Lesson 27, full transparency and honest disclosure of everything, including any mistakes.
A set of documented lab findings, drawn from the earlier module exercises, with evidence and reproduction details captured.
The habit of meticulous, timestamped documentation kept throughout an engagement, which makes accurate reporting possible.

Setup & Project Structure

Gather your documented lab findings and set up a workspace for the report, with sections for the executive summary, the technical findings, and the prioritized remediation plan. Because the report is the engagement's true product, structure it deliberately from the start. Keeping your source evidence organized alongside the draft ensures every finding is accurate, reproducible, and fully supported, which is what makes a report both credible and genuinely useful to the client who will act on it.

Analogy🏏Cricket

💪 Think of it like fitness: Serious athletes train in a controlled gym they are cleared to use and keep a meticulous logbook, dating every set and weight so progress is reproducible and any coach can pick up exactly where they left off. Just as that controlled environment and dated logbook make training safe and auditable, working inside an authorized lab and saving each phase's output in dated, named files makes the recon sweep safe and reproducible. Just as an undocumented workout teaches nothing repeatable, an undocumented sweep produces findings no teammate can trust. This reveals disciplined setup as the training log that makes every result traceable.

bash

# Set up a workspace for a two-audience report.
mkdir pentest-report && cd pentest-report
mkdir evidence draft

# Outline the report structure up front (the deliverable's backbone).
cat > draft/outline.md <<'EOF'
# Penetration Test Report — <lab environment>

1. Executive Summary        (leadership: risk, priorities, plain language)
2. Technical Findings       (engineers: severity, repro, evidence, fix)
3. Remediation Priorities   (CVSS + business context -> fix order)
4. Scope & Methodology      (what was authorized and how it was tested)
EOF
cat draft/outline.md

Step 1 — Organize and Score the Findings

Begin with the technical substance. For each lab finding, record the vulnerability, its impact, clear reproduction steps, and supporting evidence, then assign a CVSS-based severity. This is where your engagement documentation pays off, accurate reproduction and evidence make each finding credible and fixable. Work through every finding systematically so none is vague or unsupported. Precise, reproducible findings are the raw material from which both the technical section and the prioritisation will be built.

Analogy🏏Cricket

♟️ Think of it like chess: a serious player annotates a game one move at a time, recording exactly what happened, why it mattered, and the evidence from the position, before drawing any conclusions. Just as that systematic, move-by-move record is the raw material for honest analysis, documenting each finding's vulnerability, impact, reproduction steps, and evidence is the raw material for the report. Just as a consistent evaluation of each position lets moves be compared fairly, a consistent CVSS score for each finding lets them be prioritised fairly. This reveals why this step comes first: precise, reproducible, evidenced findings are the foundation everything else is built upon.

bash

# Document each finding precisely, then score it.
cat > draft/findings.md <<'EOF'
## Finding: <title>
- Severity (CVSS): <score> (<Critical/High/Medium/Low>)
- Impact: <business + technical impact>
- Reproduction: <clear, ordered steps>
- Evidence: <reference to evidence/ files>
- Remediation: <specific, actionable fix>
EOF
cat draft/findings.md   # repeat this block for every finding

Step 2 — Prioritize by Real Risk

With findings scored, set the remediation order using CVSS plus business context, not raw score alone. Weigh each issue's exposure, the value of the affected asset, and its real exploitability in the environment, so a lower-scored but exposed, critical issue can outrank a higher-scored isolated one. Produce a clear, ranked list of what to fix first and why. This context-aware prioritisation is what makes the report actionable, directing the client's limited resources at their greatest real risk.

Analogy🏏Cricket

🍳 Think of it like cooking: a chef running a busy service does not cook dishes in the order tickets arrive; they sequence by what will spoil, what the table needs first, and how long each takes. Just as the smart order reflects real urgency rather than raw arrival time, your remediation order reflects real risk rather than raw CVSS score. Just as the chef weighs which dish matters most right now, you weigh each finding's exposure, asset value, and real exploitability to decide what to fix first. This reveals what makes the plan actionable: a ranked list built on context, not score alone, directs the client's limited effort at their greatest real risk.

bash

# Prioritize by real risk (CVSS + context), and explain the reasoning.
cat > draft/priorities.md <<'EOF'
## Remediation Priorities (real-risk order)
1. <finding> — CVSS <n> + exposed/critical asset -> fix FIRST (why)
2. <finding> — CVSS <n> + moderate exposure -> next (why)
3. <finding> — CVSS <n> + isolated/low value -> later (why)

Note: order reflects real risk, not raw score alone.
EOF
cat draft/priorities.md