Pentest Report

pentest-report

Pentest rapor yazimi. Engagement sonrasi final deliverable.

Triggers

• "pentest rapor yaz"
• "executive summary"
• "technical writeup"
• "CVSS score hesapla"
• "remediation roadmap"
• "retest rapor"

Rapor Yapisi

1. Cover Page
2. Executive Summary (1-2 sayfa, non-technical)
3. Scope + Methodology (1 sayfa)
4. Risk Matrix + Summary Findings Table
5. Detailed Findings (her bulgu icin 1-2 sayfa)
6. Remediation Roadmap
7. Appendix (tool list, sample evidence, retest plan)

Executive Summary Sablonu

# Executive Summary

[Sirket Adi] tarafindan yetkilendirilen <pentest tipi> testi, [tarih araligi]
boyunca [pentest firma adi] tarafindan yurutuldu. Test scope'unda <X> asset
incelendi: [kisa scope ozeti].

## Anahtar Bulgular

Toplam <N> bulgu tespit edildi:
- **<X> Critical** — derhal mudahale gerekli
- **<X> High** — 30 gun icinde duzeltilmeli
- **<X> Medium** — 90 gun
- **<X> Low** — best effort

En ciddi bulgu: <bulgu kisa aciklamasi>. Bu zafiyet [is etkisi: musteri verisi
ifsasi / mali kayip / regulasyon ihlali] riskine yol acmaktadir.

## Genel Guvenlik Olcumu

[Sirket Adi]'in genel guvenlik olgunluk seviyesi <Initial/Repeatable/Defined/
Managed/Optimizing> olarak degerlendirildi. Onceki year baseline ile
karsilastirma: <improving / stable / degraded>.

## Stratejik Onerisi

1. <Kritik bulgu icin remediation>
2. <Surec / kultur onerisi: incident response drill, awareness training>
3. <Yatirim onerisi: SIEM coverage, MFA universal>

## Acceptance

Bu rapor [tarih] itibariyle teslim edildi. Bulgular [tarih + 7 gun]'de retest
icin aciliyor.

Bulgu Sablonu

## [BLG-001] Stored XSS in Comment Field — CRITICAL

### CVSS 3.1
**9.0 (Critical)** — `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`

### Etki
Authenticated low-priv user can inject persistent JavaScript that executes
in admin browsers, leading to:
- Full admin session hijack
- Persistent malicious payload (kalici DB kaydi)
- 1-click via existing workflow (admin moderator panel)

### Test Asamalari
1. Login: user@test.local / Test123! (low priv)
2. Navigate: /comments
3. Submit: `<img src=x
4. Wait: admin moderator review panel'i actiginda payload tetiklenir
5. Confirm: cookie attacker server'a teslim edilir

### Kanit
- `evidence/blg-001-payload.png` (HAR file ek)
- `evidence/blg-001-cookie-exfil.png`
- `evidence/blg-001-admin-impact.mp4` (60sn video)

### Etkilenen Bilesen
- File: `src/components/Comment.tsx:42`
- Component: CommentRenderer.render
- Endpoint: POST /api/comments

### Kok Sebep
Server-side comment body sanitization eksik. Frontend `dangerouslySetInnerHTML`
ile direct render.

### Onerilen Cozum

**Quick fix (1 gun)**: Server-side sanitization
```javascript
// src/api/comments.js
import DOMPurify from 'isomorphic-dompurify';
const cleanBody = DOMPurify.sanitize(req.body.body, { ALLOWED_TAGS: ['b','i','em'] });

Long-term (1 hafta):

• Content Security Policy header: default-src 'self'; script-src 'self' 'nonce-{random}'
• Cookie flag: HttpOnly + Secure + SameSite=Strict
• Code review checklist: dangerouslySetInnerHTML kullanim onayi

Doğrulama

Retest sirasinda ayni payload submit -> sanitize edilmeli, exec edilmemeli.

CWE / MITRE

• CWE-79: Improper Neutralization of Input (Cross-Site Scripting)
• MITRE: T1059.007 (Command and Scripting Interpreter: JavaScript)

Baglanti

• OWASP XSS Prevention Cheatsheet
• HackerOne similar finding

## CVSS 3.1 Calculator (Hizli)

Base Score = Impact * Exploitability

Impact = 1 - ((1-C) * (1-I) * (1-A)) C, I, A: None=0, Low=0.22, High=0.56

Exploitability = 8.22 * AV * AC * PR * UI AV: Network=0.85, Adjacent=0.62, Local=0.55, Physical=0.2 AC: Low=0.77, High=0.44 PR: None=0.85, Low=0.62, High=0.27 (Scope U) None=0.85, Low=0.68, High=0.50 (Scope C) UI: None=0.85, Required=0.62

If Scope Unchanged: if Impact <= 0: BaseScore = 0 else: BaseScore = roundup(min(Impact + Exploitability, 10))

If Scope Changed: BaseScore = roundup(min(1.08 * (Impact + Exploitability), 10))

Online: https://www.first.org/cvss/calculator/3.1

## Remediation Roadmap

```markdown
| Onceelik | Bulgu | Effort | Owner | Due | Status |
|----------|-------|--------|-------|-----|--------|
| P0 | BLG-001 Stored XSS | 8h | Frontend | 2026-05-22 | In progress |
| P0 | BLG-002 SQL Injection | 12h | Backend | 2026-05-22 | Open |
| P1 | BLG-003 Weak Cipher | 4h | DevOps | 2026-06-15 | Open |
| P2 | BLG-004 Missing HSTS | 2h | DevOps | 2026-07-30 | Open |
| P3 | BLG-005 Verbose Error | 1h | Backend | Best effort | Open |

Retest Plani

• Time window: 30 gun icinde
• Scope: sadece original engagement'tan tespit edilen bulgular
• Method: PoC reproduce + remediation verification
• Output: Per-finding "Resolved" / "Open" / "Mitigated" + delta rapor

Out-of-Scope

• Rapor pdf rendering (Latex, Word) — sablon hazir, format musteri tarafi
• Otomatik finding write (sablon var, icerik manuel insan)