DB.
Courses

Report Writing for Penetration Testers
OSCP · Chapter 2

Report Writing for Penetration Testers

A penetration test report is the deliverable the client actually pays for. A brilliant exploit chain is worthless to the business if the report cannot explain the risk, the reproduction steps and the fix in language both engineers and executives can act on.

Key concepts

  • Structure: executive summary (business risk, no jargon), technical findings (CVSS/severity, affected assets), reproduction steps, evidence (screenshots/requests), remediation.
  • Write findings so a developer with zero context could reproduce the issue from your steps alone.
  • Rate severity consistently — use CVSS v3.1 rather than "gut feeling" so findings are comparable across engagements.
  • Never include live credentials, unredacted PII or production secrets in a report that will be emailed around.

Example

## Finding: Reflected XSS in /search?q=

**Severity:** Medium (CVSS 3.1: 6.1)

**Steps to reproduce:**
1. Navigate to https://target/search?q=<script>alert(1)</script>
2. Observe the payload executes unescaped in the results page.

**Impact:** Session token theft via crafted links sent to victims.
**Fix:** Context-aware output encoding on the search results template.

Try it yourself

Take any finding you have discovered on a lab machine (or a public writeup) and rewrite it in this four-part structure. Ask whether a junior developer could act on it without asking you a follow-up question.

ReferenceSearch video walkthroughs

@ Daniel Burlacu