offensive-reporting

# Penetration Test Reporting — Professional Methodology A great finding lost in a bad report is a wasted finding. Reports are the artifact the client pays for, the auditor reads, and the developer fixes from. Treat the report with the same rigor as the exploit. ## Quick Workflow 1. Capture evidence as you exploit — never reconstruct after the fact 2. Draft each finding immediately while context is fresh; one finding = one numbered file 3. Build the executive summary last, after all findings are scored 4. Two-pass review: technical accuracy first, then read-as-CISO for narrative 5. Hand off with a retest plan and a JSON/CSV index for the client's tracking system --- ## Report Structure (Standard) ``` 1. Executive Summary ← Last to write, first read 2. Engagement Overview 2.1 Scope 2.2 Methodology 2.3 Limitations / Assumptions 2.4 Timeline 2.5 Team 3. Risk Summary ← Heatmap, finding count by severity 4. Technical Findings ← One per finding, sorted by severity 5. Attack Narratives / Chains ← Critical chains called out separately 6. Strategic Recommendations ← Programmatic, not finding-by-finding 7. Appendices A. Tools Used B. Indicators of Compromise (for blue team) C. Raw Evidence Pointers D. Glossary ``` --- ## Executive Summary — The 90-Second Read The executive summary is for the CISO, the GRC officer, and the board member. They read this and nothing else. **Structure (one page max):** 1. **...