Hack for Show, Report for Dough: Understanding the Importance of Reporting in Pen Testing

Introduction

• Presenter: BB King
• Background: Pen tester since 2008, with a Bachelor’s in Fine Arts.
• Main Theme: Importance of reporting over mere pen testing activities.

Key Concepts

The Report is Your Product

• Pen Test as a Means: A pen test is a means to produce the report, the real deliverable.
• Purpose of Testing: To make environments safer for use by identifying and mitigating vulnerabilities.
• Value of a Report: Provides actionable insights and recommendations.

Storytelling in Reports

• Reports as Stories: A good report tells the story of what was discovered during testing.
• Importance of Context: Facts should be presented with context to illustrate potential risks.

Avoiding Common Pitfalls

• Avoid Scanner Output: Do not just provide raw scanner outputs as reports.
• Include Failed Attacks: Document failed attacks to provide evidence of robustness.

Audience Consideration

• Two Audiences: Technical readers who will implement fixes, and business readers who will allocate resources.
• Technical Details: Include methodology and technical findings for technical audiences.
• Executive Summary: Simplified, non-technical overview for business stakeholders.
• Language Use: Use clear, simple language in executive summaries to communicate risks and recommendations effectively.

Tips and Techniques

Improving Report Structure

• Screenshots: Use them to illustrate, not decorate. Ensure they are precise and accurately convey the message.
• Clear Formatting: Use tools available in Microsoft Word to improve presentation and clarity.

Tools and Practices

• Microsoft Word Tips:
  • Insert Screenshot: Directly into Word for ease of use.
  • Quick Parts/Auto Text: For repetitive content.
  • Macros: Automate repetitive tasks like adding page breaks.
• Alternative Tools: Consider tools like GreenShot or Shutter for advanced screenshot needs.

Continuous Improvement

• Practice Writing: Improve by writing more (blogs, CTF write-ups) and seeking feedback.
• Read Reports: Review and edit reports voluntarily for peers to hone skills.

Final Thoughts

• Focus on Reports: Reports have lasting impact versus the transient nature of pen tests.
• Skill Development: Emphasize writing skills alongside technical skills for effective communication.

Questions and Interaction

• Engagement: Encourage questions and feedback to continually improve reporting skills.
• Networking: Join communities and discussions for broader perspectives on writing and reporting.

Conclusion

• Importance of Reporting: Crucial for ensuring actionable outcomes from pen tests.
• Continuous Learning: Encouraged to keep improving both technical and report writing skills.