# Penetration Testing Report Generation Instructions

## Objective
Generate professional, comprehensive penetration testing reports suitable for compliance audits, board reviews, and technical remediation.

## Report Structure

### 1. Executive Summary
**Audience**: C-level executives, board members, non-technical stakeholders

**Content**:
- High-level overview of assessment scope and methodology
- Total vulnerabilities by severity (Critical/High/Medium/Low)
- Business impact summary
- Key recommendations (top 3-5 priorities)
- Remediation timeline estimate
- Compliance implications

**Tone**: Business-focused, risk-oriented, actionable

**Example**:
```
EXECUTIVE SUMMARY

A comprehensive security assessment was conducted on the [Application Name] 
codebase and infrastructure between [Start Date] and [End Date]. The assessment 
identified 23 security vulnerabilities across the application stack.

KEY FINDINGS:
- 2 Critical vulnerabilities requiring immediate remediation
- 5 High-severity issues posing significant risk
- 11 Medium-severity weaknesses
- 5 Low-severity/informational findings

BUSINESS IMPACT:
The identified critical vulnerabilities could allow unauthorized access to 
customer data, potentially resulting in regulatory penalties under GDPR/CCPA 
and reputational damage. Estimated financial exposure: $2-5M in worst-case breach scenario.

IMMEDIATE ACTIONS REQUIRED:
1. Patch SQL injection vulnerability in user authentication (CRITICAL)
2. Implement rate limiting on API endpoints (CRITICAL)  
3. Update 12 outdated dependencies with known CVEs (HIGH)

Estimated remediation effort: 80-120 engineering hours over 2-3 weeks.
```

---

### 2. Assessment Scope & Methodology

**Content**:
- Systems/applications tested
- Testing timeframe
- Testing approach (static analysis, dynamic testing, manual review)
- Tools and techniques used
- Limitations and exclusions
- Environment details (production/staging/test)

**Example**:
```
SCOPE:
- Application: Customer Portal Web Application
- Version: v2.3.1 (commit SHA: abc123def)
- Components: Backend API (Python/Flask), Frontend (React), Database (PostgreSQL)
- Infrastructure: AWS EKS cluster, RDS, S3 buckets
- Testing Period: October 15-25, 2025

METHODOLOGY:
1. Static Application Security Testing (SAST)
   - Automated code analysis using Claude Penetration Testing Skill
   - Manual code review of critical authentication/authorization flows
   
2. Infrastructure Security Assessment
   - Terraform configuration review
   - Kubernetes manifest analysis
   - AWS IAM policy evaluation

3. Dependency Vulnerability Analysis
   - Python packages (requirements.txt)
   - NPM packages (package-lock.json)
   - CVE matching against NVD database

LIMITATIONS:
- Dynamic testing was limited to staging environment only
- Third-party integrations (Stripe, Auth0) were excluded
- Social engineering and physical security not assessed
```

---

### 3. Vulnerability Details

For each finding, include:

#### A. Finding Header
- **ID**: Unique identifier (FIND-001)
- **Title**: Descriptive name
- **Severity**: Critical/High/Medium/Low
- **CVSS Score**: v3.1 score (0-10)
- **CWE**: Common Weakness Enumeration ID
- **OWASP**: OWASP Top 10 classification

#### B. Vulnerability Description
- Technical explanation of the vulnerability
- How it was discovered
- Affected components/files

#### C. Proof of Concept
- Step-by-step reproduction steps
- Code snippets showing vulnerable code
- Screenshots/evidence (if dynamic testing)
- Example payloads used

#### D. Impact Analysis
- **Technical Impact**: What attacker can achieve
- **Business Impact**: Real-world consequences
- **Attack Scenario**: Realistic exploitation narrative

#### E. Remediation Guidance
- **Short-term fix**: Immediate mitigation
- **Long-term solution**: Architectural improvements
- **Code examples**: Secure implementation
- **Testing procedure**: How to verify the fix

#### F. References
- OWASP guidelines
- CWE descriptions
- CVE entries
- Framework-specific documentation

**Example Vulnerability Entry**:

```markdown
---
### FIND-001: SQL Injection in User Authentication

**Severity**: CRITICAL  
**CVSS Score**: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)  
**CWE**: CWE-89 (SQL Injection)  
**OWASP**: A03:2021 - Injection  
**Location**: `src/api/auth/login.py:42`

#### Description
A SQL injection vulnerability exists in the user authentication endpoint due to 
unsanitized user input being directly concatenated into SQL queries. An attacker 
can bypass authentication and gain unauthorized access to the application.

**Affected Code**:
```python
def authenticate(username, password):
    query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
    cursor.execute(query)  # VULNERABLE
    return cursor.fetchone()
```

#### Proof of Concept
1. Navigate to login endpoint: `POST /api/auth/login`
2. Submit the following payload:
   ```json
   {
     "username": "admin' OR '1'='1",
     "password": "anything"
   }
   ```
3. Application grants access without valid credentials

**Executed Query**:
```sql
SELECT * FROM users WHERE username = 'admin' OR '1'='1' AND password = 'anything'
```

#### Impact Analysis

**Technical Impact**:
- Authentication bypass allowing access to any user account
- Ability to extract entire database contents via UNION-based injection
- Potential for data modification or deletion via stacked queries

**Business Impact**:
- Unauthorized access to 50,000+ customer accounts
- Exposure of PII including emails, addresses, payment methods
- GDPR/CCPA violation with potential fines up to 4% of annual revenue
- Reputational damage and customer trust erosion

**Attack Scenario**:
An external attacker discovers the vulnerability through automated scanning. 
They exploit it to extract the user database, including admin credentials. 
Using admin access, they exfiltrate customer payment information and sell it 
on dark web marketplaces. The breach is discovered 3 weeks later during a 
routine audit, by which time 5,000 customers have reported fraudulent charges.

#### Remediation

**Immediate Mitigation** (Deploy within 24 hours):
```python
def authenticate(username, password):
    query = "SELECT * FROM users WHERE username = %s AND password = %s"
    cursor.execute(query, (username, password))  # SECURE - parameterized
    return cursor.fetchone()
```

**Long-term Solution**:
1. Implement ORM (SQLAlchemy) for all database interactions
2. Add input validation layer:
   ```python
   from pydantic import BaseModel, validator
   
   class LoginRequest(BaseModel):
       username: str
       password: str
       
       @validator('username')
       def validate_username(cls, v):
           if not re.match(r'^[a-zA-Z0-9_]+$', v):
               raise ValueError('Invalid username format')
           return v
   ```
3. Implement prepared statement enforcement via database connection settings
4. Add WAF rules to detect SQL injection patterns

**Testing Verification**:
1. Attempt injection payloads: `' OR '1'='1`, `'; DROP TABLE users--`
2. Verify application rejects input or safely escapes it
3. Run automated SQL injection scanner (sqlmap) against endpoint
4. Code review to confirm parameterized queries throughout codebase

#### References
- [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)
- [CWE-89: Improper Neutralization of Special Elements used in an SQL Command](https://cwe.mitre.org/data/definitions/89.html)
- [Python DB-API Parameterized Queries](https://peps.python.org/pep-0249/)

---
```

---

### 4. Risk Summary Matrix

Provide a visual risk matrix categorizing findings:

```
SEVERITY DISTRIBUTION:

Critical  [██████████] 2 findings
High      [█████████████████████████] 5 findings  
Medium    [█████████████████████████████████████████████████] 11 findings
Low       [█████████████] 5 findings

CATEGORY BREAKDOWN:

Injection                [█████] 3 findings
Broken Authentication    [███] 2 findings
Sensitive Data Exposure  [████] 2 findings
Access Control          [██████] 4 findings
Security Misconfiguration [████████] 5 findings
XSS                     [██] 1 finding
Vulnerable Dependencies [██████████] 7 findings
```

---

### 5. Remediation Roadmap

Provide prioritized remediation timeline:

```
PHASE 1: IMMEDIATE (0-1 week)
✓ FIND-001: Patch SQL injection in authentication (8 hours)
✓ FIND-002: Implement API rate limiting (4 hours)
✓ FIND-003: Disable debug mode in production (1 hour)

PHASE 2: SHORT-TERM (1-3 weeks)  
□ FIND-004-008: Update vulnerable dependencies (16 hours)
□ FIND-009: Implement CSRF protection (8 hours)
□ FIND-010: Add security headers (4 hours)

PHASE 3: MEDIUM-TERM (1-2 months)
□ FIND-011-015: Refactor access control logic (40 hours)
□ FIND-016: Implement comprehensive logging (16 hours)
□ FIND-017-020: Infrastructure hardening (24 hours)

PHASE 4: LONG-TERM (2-6 months)
□ Architecture review and security design patterns
□ Implement automated security testing in CI/CD
□ Security training for development team
□ Establish secure SDLC practices
```

---

### 6. Appendices

#### A. Testing Evidence
- Screenshots of successful exploits
- Log excerpts
- Network traffic captures
- Proof-of-concept code

#### B. CVSS Scoring Details
- Full CVSS vector strings for all findings
- Scoring justification

#### C. Compliance Mapping
Map findings to relevant frameworks:
- OWASP Top 10 2021
- CWE Top 25
- PCI-DSS requirements
- NIST Cybersecurity Framework
- ISO 27001 controls

#### D. Tool Output
- Raw scanner results (if applicable)
- Dependency vulnerability reports

---

## Output Formats

### JSON (Machine-readable)
```json
{
  "report_metadata": {
    "report_id": "PENTEST-2025-001",
    "generated_at": "2025-10-25T14:30:00Z",
    "assessment_period": "2025-10-15 to 2025-10-25",
    "scope": "Customer Portal v2.3.1",
    "tester": "Claude Penetration Testing Skill v1.0"
  },
  "executive_summary": {
    "total_findings": 23,
    "severity_distribution": {
      "critical": 2,
      "high": 5,
      "medium": 11,
      "low": 5
    },
    "key_risks": ["SQL Injection", "Vulnerable Dependencies"],
    "remediation_timeline": "2-3 weeks"
  },
  "findings": [
    {
      "id": "FIND-001",
      "title": "SQL Injection in Authentication",
      "severity": "CRITICAL",
      "cvss_score": 9.8,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "cwe": "CWE-89",
      "owasp": "A03:2021",
      "file": "src/api/auth/login.py",
      "line": 42,
      "description": "...",
      "impact": "...",
      "remediation": "...",
      "references": []
    }
  ]
}
```

### HTML (Professional Report)
- Styled with corporate branding
- Interactive table of contents
- Syntax-highlighted code snippets
- Downloadable as standalone file

### PDF (Executive Distribution)
- Print-ready format
- Executive summary on page 1
- Detailed findings in appendices

### Markdown (PR Comments)
- Concise inline comments
- Links to relevant documentation
- Suggested code fixes

---

## Tone & Language Guidelines

1. **Executive Summary**: Business language, quantified risks, actionable recommendations
2. **Technical Sections**: Precise technical details, include code examples
3. **Remediation**: Step-by-step instructions, verifiable outcomes
4. **Avoid**: Fear-mongering, exaggeration, blame
5. **Emphasize**: Constructive guidance, education, partnership

---

## Quality Checklist

Before finalizing report:

- [ ] All findings have unique IDs
- [ ] CVSS scores calculated correctly
- [ ] Remediation guidance is actionable
- [ ] Code examples are tested and correct
- [ ] No sensitive data (passwords, API keys) in report
- [ ] Spelling and grammar checked
- [ ] Report renders correctly in all formats (HTML, PDF, JSON)
- [ ] Executive summary fits on one page
- [ ] References are valid and accessible

