Pentest Reporting

PTES Phase 6: Reporting

🎯 pfSense Detection & Routing

DETECTION: Se o alvo for pfSense, ative a skill pentest-pfsense para metodologia completa.

Detection Signals

• Web GUI title contains "pfSense"
• HTTP headers: Server: pfsense, X-Powered-By: pfSense
• Default paths: /firewall_rules.php, /system.php, /diag_logs.php
• Shodan: http.title:"pfSense", http.favicon.hash:-1295592153
• nmap: http.title script returns "pfSense"

Action

→ Activate pentest-pfsense skill for:

• Complete pentest methodology (12 phases)
• 27+ CVEs organized by exploitability
• Feature-based testing checklist (158 features)
• Stealth scanning guidance (firewall-aware)
• PoC templates and exploitation workflows

🎯 pfSense Findings Integration

IMPORTANTE: Se pfSense foi testado durante o engagement, use a skill pentest-pfsense como referência para findings específicos.

pfSense Finding Templates

Critical Findings (CVSS 9.0+)

- CVE-2022-40624: pfBlockerNG Host Header RCE (CVSS 9.8)
- CVE-2022-31814: pfBlockerNG Path Traversal RCE (CVSS 9.8)
- CVE-2025-12490: Suricata Path Traversal → RCE (CVSS 8.8)
- CVE-2023-42326: Command Injection (GIF/GRE interfaces) (CVSS 8.8)
- CVE-2023-48123: Packet Capture RCE (CVSS 8.8)

High Findings (CVSS 7.0-8.9)

- CVE-2023-27253: RRD Restore Command Injection (CVSS 8.8)
- CVE-2023-48795: Terrapin SSH Attack (CVSS 5.9, EPSS 99º)
- CVE-2025-34172: HAProxy XSS + Socket Injection (CVSS 6.1)
- CVE-2025-34175: Suricata Reflected XSS (CVSS 6.1)

Medium Findings (CVSS 4.0-6.9)

- CVE-2025-53392: Arbitrary File Read (CVSS 6.5)
- CVE-2022-29273: Stored XSS via URL Alias (CVSS 6.1)
- CVE-2024-57273: OpenVPN DoS (CVSS 5.3)
- CVE-2025-34174: Status Traffic Totals XSS (CVSS 5.4)

Remediation Guidance

pfSense-Specific Recommendations:

1. UPGRADE IMEDIATO
   - pfSense CE: 2.7.x → 2.8.0+
   - pfSense Plus: 23.09 → 24.03+
   - Packages: pfBlockerNG, Suricata, Snort (latest)

2. MITIGAÇÕES TEMPORÁRIAS
   - System Patches package (Netgate recomendado)
   - Desabilitar serviços não essenciais
   - Restringir acesso à webGUI por IP
   - Remover privilégios de diagnóstico

3. MONITORAMENTO
   - Alertas de login falho
   - Log de alterações de config
   - Detecção de comandos suspeitos

Compliance Mapping

pfSense Findings → Frameworks:

| Finding | MITRE ATT&CK | CIS Control | NIST |
|---------|--------------|-------------|------|
| RCE via diag_command.php | T1190 (Exploit Public-Facing App) | 7.1 (Vuln Mgmt) | SI-2 |
| Default credentials | T1078 (Valid Accounts) | 5.2 (Account Mgmt) | IA-2 |
| Config file access | T1003 (Credential Dumping) | 3.5 (Access Control) | AC-3 |
| HA sync abuse | T1563 (Service Session Hijack) | 4.4 (Comm Protection) | SC-23 |

Objetivo

Documentar detalhadamente todos os achados, riscos associados, evidências e recomendações de correção para o cliente.

Referências PTES Section 6

PTES 6.1 Executive-Level Reporting

• Business Impact
• Customization for audience
• Talking to the business
• Affect bottom line
• Strategic Roadmap
• Maturity model
• Appendix with terms for risk rating

PTES 6.2 Technical Reporting

• Identify systemic issues and technical root cause analysis
• Maturity Model
• Technical Findings (Description, Screenshots, PII redacted, Request/Response, PoC)
• Reproducible Results (Test Cases, Fault triggers)
• Incident response and monitoring capabilities
• Common elements (Methodology, Objective, Scope, Summary, Risk rating appendix)

PTES 6.3 Quantifying the Risk

• Evaluate incident frequency
• Risk matrix (Probability × Impact)
• CVSS scoring integration
• Business context weighting

PTES 6.4 Deliverable

• Final report formats (PDF, HTML, JSON, CSV)
• Presentation to stakeholders
• Lessons learned documentation
• Re-testing recommendations

Geração de Relatórios com WorstAssume

0. OWASP Nettacker Export Formats (PTES 6.4 - Deliverable)

NOTE: Nettacker supports 5 output formats for different stakeholders and integrations.

Output Formats Available

# HTML Report (with graphs) - For executives and non-technical stakeholders
docker run --rm -v $(pwd):/tmp owasp/nettacker \
  -i TARGET -m port_scan,vuln \
  --graph-output /tmp/nettacker_report.html

# JSON - For programmatic processing and SIEM integration
docker run --rm -v $(pwd):/tmp owasp/nettacker \
  -i TARGET -m port_scan,vuln \
  --json-output /tmp/nettacker_report.json

# CSV - For spreadsheet analysis and filtering
docker run --rm -v $(pwd):/tmp owasp/nettacker \
  -i TARGET -m port_scan,vuln \
  --csv-output /tmp/nettacker_report.csv

# SARIF - For GitHub Security tab and code scanning tools
docker run --rm -v $(pwd):/tmp owasp/nettacker \
  -i TARGET -m port_scan,vuln \
  --sarif-output /tmp/nettacker_report.sarif

# DefectDojo (.dd.json) - For DefectDojo vulnerability management platform
docker run --rm -v $(pwd):/tmp owasp/nettacker \
  -i TARGET -m port_scan,vuln \
  --dd-output /tmp/nettacker_report.dd.json

Format Comparison

Nettacker + WorstAssume Combined Export

# Step 1: Nettacker external scan
docker run --rm -v $(pwd):/tmp owasp/nettacker \
  -i TARGET.com -m port_scan,vuln,ssl_*_vuln \
  --json-output /tmp/nettacker_external.json \
  --graph-output /tmp/nettacker_external.html

# Step 2: WorstAssume AWS enumeration
worst enumerate --profile <profile> --output json > /tmp/worstassume_aws.json

# Step 3: Consolidate findings
jq -s '{
  nettacker: .[0],
  worstassume: .[1],
  generated_at: now
}' /tmp/nettacker_external.json /tmp/worstassume_aws.json \
  > /tmp/consolidated_findings.json

# Step 4: Generate executive summary
jq -r '.nettacker.results[] | "Finding: \(.title)\nSeverity: \(.severity)\nTarget: \(.target)"' \
  /tmp/nettacker_external.json > /tmp/executive_summary.txt

1. Exportar Dados do Assessment

# Exportar findings em JSON estruturado
worst privesc --from <arn> --output json > attack-paths.json

# Exportar grafo completo para análise
worst graph-export --output graph.json

# Dashboard web para visualização
worst viz --port 3000
# Acessar http://localhost:3000 e usar Export

2. Comandos de Export Específicos

# Listar todas as cadeias de ataque detectadas
worst privesc --db findings.db --all

# Filtrar por severidade mínima
worst privesc --db findings.db --min-severity HIGH

# Exportar por família de ataque
worst privesc --db findings.db --family "IAM Self-Modification" --output family-iam.json
worst privesc --db findings.db --family "PassRole+Compute" --output family-passrole.json
worst privesc --db findings.db --family "Compute Credential Theft" --output family-compute.json
worst privesc --db findings.db --family "Secret Exfiltration" --output family-secret.json
worst privesc --db findings.db --family "Account Takeover" --output family-account.json
worst privesc --db findings.db --family "Group Membership" --output family-group.json
worst privesc --db findings.db --family "Cross-Account Lateral Movement" --output family-crossaccount.json

# Exportar todos os PATH-IDs descobertos
worst privesc --db findings.db --output all-paths.json --include-all

3. Estrutura do JSON de Export (SecurityFinding Schema)

{
  "finding_id": "FINDING-001",
  "path_id": "PATH-001",
  "category": "WEAK_TRUST",
  "subcategory": "WildcardTrustNoCondition",
  "severity": "CRITICAL",
  "original_severity": "CRITICAL",
  "downgrade_reason": null,
  "principal_arn": "arn:aws:iam::123456789012:role/ExampleRole",
  "principal_type": "ROLE",
  "account_id": "123456789012",
  "region": "us-east-1",
  "trust_policy": {
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": "*",
      "Action": "sts:AssumeRole"
    }]
  },
  "permissions": ["iam:*", "ec2:*", "s3:*"],
  "managed_policies": ["arn:aws:iam::aws:policy/AdministratorAccess"],
  "inline_policies": ["FullAccess"],
  "groups": ["Admins"],
  "risk_factors": {
    "has_wildcard_trust": true,
    "has_external_account_trust": false,
    "has_dangerous_managed_policy": true,
    "has_resource_wildcard": true,
    "missing_condition_keys": true
  },
  "attack_chain": {
    "family": "IAM Self-Modification",
    "chain_id": "CreatePolicy+Attach",
    "hops": 2,
    "outcome": "Self Admin Escalation"
  },
  "evidence": {
    "command": "aws iam get-role --role-name ExampleRole",
    "output": "{...}"
  },
  "recommendation": "Remove wildcard principal from trust policy. Add condition keys: aws:PrincipalArn, aws:SourceAccount",
  "remediation_effort": "LOW",
  "cvss_score": 9.8,
  "created_at": "2026-04-24T10:30:00Z"
}

4. Query Direta no Banco SQLite

# Exportar todos os findings CRITICAL
sqlite3 findings.db "SELECT * FROM SecurityFinding WHERE severity='CRITICAL';"

# Count por categoria
sqlite3 findings.db "SELECT category, COUNT(*) as count FROM SecurityFinding GROUP BY category;"

# Count por severidade
sqlite3 findings.db "SELECT severity, COUNT(*) as count FROM SecurityFinding GROUP BY severity ORDER BY severity;"

# Findings com AdministratorAccess
sqlite3 findings.db "SELECT principal_arn, path_id FROM SecurityFinding WHERE managed_policies LIKE '%AdministratorAccess%';"

# Exportar em formato JSON
sqlite3 findings.db ".mode json" ".output findings.json" "SELECT * FROM SecurityFinding;"

5. Dashboard Viz - Exportação

# Iniciar dashboard
worst viz --db findings.db --port 3000

# No browser (http://localhost:3000):
# 1. Filtrar por severidade (dropdown)
# 2. Filtrar por categoria (dropdown)
# 3. Click em "Export JSON" ou "Export CSV"
# 4. Download do arquivo formatado

6. Database Schema para Export

-- Tabela principal: SecurityFinding
CREATE TABLE SecurityFinding (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    finding_id TEXT UNIQUE NOT NULL,      -- FINDING-0001
    path_id TEXT NOT NULL,                 -- PATH-001
    category TEXT NOT NULL,                -- WEAK_TRUST, PERMISSIVE_POLICY, etc.
    subcategory TEXT NOT NULL,             -- WildcardTrustNoCondition, etc.
    severity TEXT NOT NULL,                -- CRITICAL, HIGH, MEDIUM, LOW, INFO
    original_severity TEXT NOT NULL,       -- Severidade antes do downgrade
    downgrade_reason TEXT,                 -- Motivo do downgrade se aplicável
    principal_arn TEXT NOT NULL,           -- ARN do principal afetado
    principal_type TEXT NOT NULL,          -- USER, ROLE, GROUP, ROOT
    account_id TEXT NOT NULL,              -- 123456789012
    region TEXT,                           -- us-east-1, etc.
    trust_policy TEXT,                     -- JSON do trust policy
    permissions TEXT,                      -- JSON array de permissões
    managed_policies TEXT,                 -- JSON array de managed policies
    inline_policies TEXT,                  -- JSON array de inline policies
    groups TEXT,                           -- JSON array de grupos
    risk_factors TEXT,                     -- JSON com fatores de risco
    attack_chain TEXT,                     -- JSON da attack chain
    evidence TEXT,                         -- JSON com evidências
    recommendation TEXT,                   -- Texto da recomendação
    remediation_effort TEXT,               -- LOW, MEDIUM, HIGH
    cvss_score REAL,                       -- 0.0-10.0
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

-- Índices para performance
CREATE INDEX idx_severity ON SecurityFinding(severity);
CREATE INDEX idx_category ON SecurityFinding(category);
CREATE INDEX idx_account ON SecurityFinding(account_id);
CREATE INDEX idx_principal ON SecurityFinding(principal_arn);

7. Workflow de Export para Relatório

# Passo 1: Exportar todos os findings
sqlite3 findings.db ".mode json" ".output all-findings.json" "SELECT * FROM SecurityFinding ORDER BY severity, category;"

# Passo 2: Exportar apenas CRITICAL + HIGH
sqlite3 findings.db ".mode json" ".output critical-high.json" "SELECT * FROM SecurityFinding WHERE severity IN ('CRITICAL', 'HIGH') ORDER BY severity DESC;"

# Passo 3: Gerar resumo estatístico
sqlite3 findings.db <<EOF
.mode column
.headers on
.output summary.txt
SELECT 
    severity,
    COUNT(*) as total,
    COUNT(DISTINCT account_id) as accounts_affected,
    COUNT(DISTINCT category) as categories
FROM SecurityFinding 
GROUP BY severity 
ORDER BY 
    CASE severity 
        WHEN 'CRITICAL' THEN 1 
        WHEN 'HIGH' THEN 2 
        WHEN 'MEDIUM' THEN 3 
        WHEN 'LOW' THEN 4 
        WHEN 'INFO' THEN 5 
    END;
EOF

# Passo 4: Exportar por categoria para análise separada
for category in WEAK_TRUST PERMISSIVE_POLICY RESOURCE_WILDCARD USER_CONFIG GROUP_CONFIG; do
    sqlite3 findings.db ".mode json" ".output category-${category}.json" "SELECT * FROM SecurityFinding WHERE category='${category}';"
done

# Passo 5: Gerar CSV para tracking em planilhas
sqlite3 findings.db <<EOF
.mode csv
.headers on
.output findings.csv
SELECT 
    finding_id,
    severity,
    category,
    subcategory,
    principal_arn,
    recommendation
FROM SecurityFinding 
ORDER BY severity, finding_id;
EOF

8. Template de Finding Técnico (PTES 6.2)

# FINDING-XXX: [Título do Finding]

## Metadados
- **Severity:** [CRITICAL/HIGH/MEDIUM/LOW/INFO]
- **Category:** [WEAK_TRUST/PERMISSIVE_POLICY/RESOURCE_WILDCARD/USER_CONFIG/GROUP_CONFIG]
- **Path-ID:** [PATH-XXX]
- **CVSS Score:** [X.X]
- **Affected Principal:** `arn:aws:iam::ACCOUNT:resource/name`
- **Account:** [123456789012]
- **Region:** [us-east-1]

## Descrição
[Descrição técnica detalhada do finding, explicando a vulnerabilidade
e como foi descoberta através do WorstAssume.]

## Evidência
```json
{
  "principal_arn": "arn:aws:iam::123456789012:role/ExampleRole",
  "trust_policy": {...},
  "permissions": ["iam:*", "ec2:*", "s3:*"],
  "managed_policies": ["arn:aws:iam::aws:policy/AdministratorAccess"]
}

Attack Path

[Identidade Inicial]
    │
    │ [Ação 1: iam:CreatePolicy]
    ▼
[Recurso Intermediário]
    │
    │ [Ação 2: iam:AttachUserPolicy]
    ▼
[Objetivo Final - Admin Access]

Impacto

[Descrição do impacto se explorado, incluindo:

• Dados que podem ser acessados
• Ações que podem ser executadas
• Contas que podem ser comprometidas]

Recomendação

[Passos específicos para remediar, incluindo comandos AWS CLI exatos.]

Comando de Correção

aws iam [comando específico]

Policy Corrigida

{
  "Version": "2012-10-17",
  "Statement": [...]
}

Referências

• AWS IAM Best Practices
• AWS Security Best Practices

### 9. Validação de Qualidade do Export

```bash
# Verificar count total de findings
TOTAL=$(sqlite3 findings.db "SELECT COUNT(*) FROM SecurityFinding;")
echo "Total findings: $TOTAL"

# Verificar distribuição por severidade
sqlite3 findings.db "SELECT severity, COUNT(*) FROM SecurityFinding GROUP BY severity;"

# Verificar findings sem recomendação (erro de qualidade)
sqlite3 findings.db "SELECT finding_id FROM SecurityFinding WHERE recommendation IS NULL OR recommendation = '';"

# Verificar findings sem evidence (erro de qualidade)
sqlite3 findings.db "SELECT finding_id FROM SecurityFinding WHERE evidence IS NULL OR evidence = '{}';"

# Validar JSON exports
for f in *.json; do
    jq empty "$f" && echo "$f: OK" || echo "$f: INVALID JSON"
done

2. Estrutura do Relatório

Seção 1: Executive Summary

RESUMO EXECUTIVO

ENGAGEMENT: [Nome do Projeto]
PERÍODO: [Data início] - [Data fim]
CLASSIFICAÇÃO: [Confidencial]

VISÃO GERAL:
[Parágrafo descrevendo o escopo e objetivos do teste]

SUMÁRIO DE RISCOS:
┌─────────────┬───────┬────────────┐
│ Severidade  │ Count │ Trend      │
├─────────────┼───────┼────────────┤
│ CRITICAL    │   X   │ [↑↓→]      │
│ HIGH        │   X   │ [↑↓→]      │
│ MEDIUM      │   X   │ [↑↓→]      │
│ LOW         │   X   │ [↑↓→]      │
│ INFO        │   X   │ [↑↓→]      │
└─────────────┴───────┴────────────┘

PRINCIPAIS ACHADOS:
1. [Finding crítico #1 - 1 linha]
2. [Finding crítico #2 - 1 linha]
3. [Finding crítico #3 - 1 linha]

RISCO GERAL: [CRITICAL / HIGH / MEDIUM / LOW]

RECOMENDAÇÕES PRIORITÁRIAS:
1. [Recomendação crítica #1]
2. [Recomendação crítica #2]
3. [Recomendação crítica #3]

Seção 2: Escopo e Metodologia

ESCOPO E METODOLOGIA

CONTAS AWS TESTADAS:
- Account ID: [123456789012] - [Nome/Nome do ambiente]
- Account ID: [234567890123] - [Nome/Nome do ambiente]
- Total: [X] contas

REGIÕES TESTADAS:
- [us-east-1, us-west-2, eu-west-1, ...]

SERVIÇOS TESTADOS:
- IAM (Identity and Access Management)
- EC2 (Elastic Compute Cloud)
- S3 (Simple Storage Service)
- Lambda (Serverless Computing)
- ECS (Elastic Container Service)
- [Outros serviços...]

METODOLOGIA:
Este assessment seguiu o PTES (Penetration Testing Execution Standard)
com as seguintes fases:

1. Pre-Engagement Interactions
2. Intelligence Gathering
3. Threat Modeling
4. Vulnerability Analysis
5. Exploitation
6. Post-Exploitation
7. Reporting

FERRAMENTAS UTILIZADAS:
- WorstAssume v[X.X.X] - AWS IAM enumeration and attack graph analysis
- AWS CLI v[X.X.X] - Manual verification and exploitation
- [Outras ferramentas...]

TIPO DE TESTE:
[ ] Black Box
[ ] Grey Box
[✓] White Box

LIMITAÇÕES:
- [Serviços não testados]
- [Restrições de tempo]
- [Restrições de acesso]

Seção 3: Findings Detalhados

FINDINGS DETALHADOS

═══════════════════════════════════════════════════════════════════════════
FINDING #1: [Título do Finding]
═══════════════════════════════════════════════════════════════════════════

SEVERIDADE: [CRITICAL / HIGH / MEDIUM / LOW / INFO]
CATEGORIA: [WEAK_TRUST / PERMISSIVE_POLICY / RESOURCE_WILDCARD / etc.]
PATH-ID: [PATH-XXX]
CVSS SCORE: [X.X] (opcional)

AFETADOS:
- Tipo: [IAM User / IAM Role / EC2 Instance / etc.]
- ARN: arn:aws:iam::ACCOUNT:resource/name
- Conta: [123456789012]
- Região: [us-east-1]

DESCRIÇÃO:
[Descrição detalhada da vulnerabilidade em 2-3 parágrafos. Explicar o que
foi encontrado, por que é um problema, e como foi descoberto.]

IMPACTO:
[Descrição do impacto potencial se esta vulnerabilidade for explorada.
Incluir cenários de pior caso e dados que podem ser comprometidos.]

PROVA DE CONCEITO:
# Comandos executados durante o teste
aws [comando 1]
aws [comando 2]

# Output observado
{
  "evidence": "output aqui"
}

ATTACK PATH:
[A] Identidade Inicial (arn:aws:iam::...)
    │
    │ iam:CreatePolicyVersion
    ▼
[B] Policy Version Criada
    │
    │ iam:AttachUserPolicy
    ▼
[C] Admin Access Obtido

RECOMENDAÇÃO:
[Passos específicos para remediar esta vulnerabilidade. Ser o mais
específico possível, incluindo comandos ou configurações exatas.]

REMEDIATION EXAMPLE:
# Exemplo de comando para corrigir
aws iam [comando de correção]

# Exemplo de policy corrigida
{
  "Version": "2012-10-17",
  "Statement": [...]
}

PRIORIDADE: [IMEDIATA / ALTA / MÉDIA / BAIXA]
ESFORÇO ESTIMADO: [X horas/dias]
DIFFICULDADE: [Fácil / Média / Difícil]

REFERÊNCIAS:
- AWS IAM Best Practices: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
- AWS Security Best Practices: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-best-practices.html
- [Outras referências relevantes]

Seção 4: Attack Paths Descobertos

ATTACK PATHS DESCOBERTOS

PATH #1: [Nome do Attack Path]
─────────────────────────────────
SEVERIDADE: CRITICAL
HOPS: [X]
DE → PARA: [Identidade inicial] → [Objetivo final]

SEQUÊNCIA DE AÇÕES:
┌────┬─────────────────────────────────┬──────────────────────────────────┐
│ #  │ Ação                            │ Explicação                       │
├────┼─────────────────────────────────┼──────────────────────────────────┤
│ 1  │ iam:CreatePolicyVersion         │ Criar versão admin da policy     │
│ 2  │ iam:AttachUserPolicy            │ Attach policy ao próprio user    │
│ 3  │ sts:GetCallerIdentity           │ Verificar permissões elevadas    │
└────┴─────────────────────────────────┴──────────────────────────────────┘

TEMPO ESTIMADO DE EXPLORAÇÃO: [X minutos/horas]
DETECÇÃO: [Baixa / Média / Alta]
MITIGAÇÃO: [Resumo da mitigação]

[Incluir diagrama visual se possível]

Seção 5: Matriz de Riscos

MATRIZ DE RISCOS

                    IMPACTO
              Baixo  Médio  Alto  Crítico
PROB.  Alta    [M]    [H]    [C]    [C]
       Média   [L]    [M]    [H]    [C]
       Baixa   [L]    [L]    [M]    [H]

FINDINGS NA MATRIZ:
┌─────────────────────────────────────┬────────────┬───────────┬───────────┐
│ Finding                             │ Probabilidade │ Impacto   │ Risco     │
├─────────────────────────────────────┼────────────┼───────────┼───────────┤
│ Wildcard Trust Policy               │ Alta       │ Crítico   │ CRITICAL  │
│ IAM Admin via Policy Version        │ Média      │ Crítico   │ CRITICAL  │
│ Cross-Account Lateral Movement      │ Média      │ Alto      │ HIGH      │
│ IMDSv1 Credential Theft             │ Alta       │ Médio     │ HIGH      │
│ Stale Access Keys                   │ Baixa      │ Médio     │ MEDIUM    │
└─────────────────────────────────────┴────────────┴───────────┴───────────┘

Seção 6: Apêndices

APÊNDICES

APÊNDICE A: COMANDOS EXECUTADOS
[Lista completa de todos os comandos AWS CLI executados]

APÊNDICE B: EVIDÊNCIAS
[Screenshots, outputs, logs de todas as explorações]

APÊNDICE C: GLOSSÁRIO
[Definições de termos técnicos usados no relatório]

APÊNDICE D: REFERÊNCIAS
[Lista completa de referências e documentação AWS]

APÊNDICE E: HISTÓRICO DE MUDANÇAS
┌────────────┬───────────────┬────────────────────────────────────────────┐
│ Versão     │ Data          │ Mudanças                                   │
├────────────┼───────────────┼────────────────────────────────────────────┤
│ 1.0        │ YYYY-MM-DD    │ Versão inicial do relatório                │
│ 1.1        │ YYYY-MM-DD    │ Adicionado finding #X, atualizado finding #Y│
└────────────┴───────────────┴────────────────────────────────────────────┘

9. Nettacker Report Templates

HTML Report Template (Executive)

# Generate HTML report with graphs
docker run --rm -v $(pwd):/reports owasp/nettacker \
  -i TARGET.com -m port_scan,vuln,ssl_*_vuln \
  --graph-output /reports/executive_report.html

# Open in browser for presentation
firefox /reports/executive_report.html

HTML Report Sections:

• Executive Summary with severity charts
• Vulnerability timeline
• Network topology graph
• CVE details with CVSS scores
• Remediation recommendations

JSON Export for SIEM Integration

# Generate JSON for Splunk/ELK
docker run --rm -v $(pwd):/reports owasp/nettacker \
  -i TARGET.com -m port_scan,vuln \
  --json-output /reports/siem_export.json

# Parse for specific findings
jq '.results[] | select(.severity == "CRITICAL")' /reports/siem_export.json

# Convert to ECS format for Elasticsearch
jq '.results[] | {
  "@timestamp": .date,
  "host": {"ip": .target},
  "vulnerability": {
    "cve": .cve_id,
    "severity": .severity,
    "description": .description
  }
}' /reports/siem_export.json > /reports/ecs_format.json

CSV Export for Spreadsheet Analysis

# Generate CSV for Excel/Google Sheets
docker run --rm -v $(pwd):/reports owasp/nettacker \
  -i TARGET.com -m port_scan,vuln \
  --csv-output /reports/findings.csv

# Filter in Excel/Sheets:
# - Sort by severity
# - Filter by target
# - Pivot by vulnerability type

CSV Columns:

Target,Port,Vulnerability,Severity,CVSS,Description,Remediation,Date

SARIF Export for GitHub Security

# Generate SARIF for GitHub Security tab
docker run --rm -v $(pwd):/reports owasp/nettacker \
  -i TARGET.com -m vuln \
  --sarif-output /reports/github_security.sarif

# Upload to GitHub
gh api \
  --method POST \
  /repos/OWNER/REPO/code-scanning/sarifs \
  -f commit_sha=$(git rev-parse HEAD) \
  -f ref=refs/heads/main \
  -f sarif=$(base64 -i /reports/github_security.sarif)

DefectDojo Integration

# Generate DefectDojo format
docker run --rm -v $(pwd):/reports owasp/nettacker \
  -i TARGET.com -m port_scan,vuln \
  --dd-output /reports/defectdojo.json

# Upload to DefectDojo via API
curl -X POST "https://defectdojo.local/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_KEY" \
  -F "file=@/reports/defectdojo.json" \
  -F "engagement=$ENGAGEMENT_ID" \
  -F "scan_type=Nettacker Scan"

10. Templates de Export

JSON Export (Estruturado)

{
  "reportMetadata": {
    "engagementName": "AWS Security Assessment",
    "client": "Client Name",
    "dateRange": {
      "start": "YYYY-MM-DD",
      "end": "YYYY-MM-DD"
    },
    "reportVersion": "1.0",
    "classification": "Confidential"
  },
  "executiveSummary": {
    "totalFindings": 15,
    "bySeverity": {
      "CRITICAL": 3,
      "HIGH": 5,
      "MEDIUM": 4,
      "LOW": 2,
      "INFO": 1
    },
    "overallRisk": "HIGH"
  },
  "findings": [...],
  "attackPaths": [...],
  "scope": {...},
  "methodology": {...}
}

CSV Export (Para planilhas)

FindingID,Severity,Category,Title,AffectedResource,Recommendation,Status
FINDING-001,CRITICAL,WEAK_TRUST,Wildcard Trust Policy,arn:aws:iam::123:role/X,Remove wildcard principal,Open
FINDING-002,HIGH,PERMISSIVE_POLICY,Admin Access,arn:aws:iam::123:user/Y,Remove admin policy,Open

11. Checklist de Qualidade do Relatório

Conteúdo

• Executive summary claro e conciso
• Todos os findings documentados com evidências
• Attack paths visualmente representados
• Recomendações acionáveis e específicas
• Priorização clara (CRITICAL > HIGH > MEDIUM > LOW)
• Referências relevantes incluídas

Formatação

• Numeração consistente de findings
• Headers e subheaders hierárquicos
• Código formatado em blocks monospace
• Tabelas alinhadas e legíveis
• Diagramas/imagens com legendas
• Índice/TOC para relatórios longos

Revisão

• Verificar ortografia e gramática
• Validar todos os ARNs e comandos
• Confirmar severidades estão corretas
• Remover dados sensíveis do relatório
• Verificar consistência de terminologia
• Revisar por múltiplos revisores

12. Apresentação para Stakeholders

Slide Deck Structure

SLIDE 1: Title Slide
- Project name, date, presenter

SLIDE 2: Executive Summary
- Overall risk rating
- Key findings (top 3-5)

SLIDE 3: Scope & Methodology
- What was tested
- How it was tested

SLIDE 4-8: Critical Findings
- One slide per critical finding
- Visual representation of attack path

SLIDE 9: Risk Matrix
- Visual risk matrix with findings plotted

SLIDE 10: Recommendations
- Prioritized remediation roadmap

SLIDE 11: Timeline
- Remediation timeline with milestones

SLIDE 12: Q&A

12. Risk Quantification (PTES 6.3)

Risk Matrix Template

                    IMPACTO
              Baixo  Médio  Alto  Crítico
PROB.  Alta    [M]    [H]    [C]    [C]
       Média   [L]    [M]    [H]    [C]
       Baixa   [L]    [L]    [M]    [H]

Finding Placement Example:
┌─────────────────────────────────────┬────────────┬───────────┬───────────┐
│ Finding                             │ Probabilidade │ Impacto   │ Risco     │
├─────────────────────────────────────┼────────────┼───────────┼───────────┤
│ Wildcard Trust Policy               │ Alta       │ Crítico   │ CRITICAL  │
│ SQL Injection                       │ Média      │ Crítico   │ CRITICAL  │
│ Cross-Account Lateral Movement      │ Média      │ Alto      │ HIGH      │
│ Stored XSS                          │ Alta       │ Médio     │ HIGH      │
│ Missing Security Headers            │ Baixa      │ Baixo     │ LOW       │
└─────────────────────────────────────┴────────────┴───────────┴───────────┘

Business Impact Weighting

Industry-Specific Considerations:

Healthcare (HIPAA):
- PHI exposure = Automatic HIGH/CRITICAL
- Patient safety impact = CRITICAL

Financial (PCI-DSS, SOX):
- Cardholder data = CRITICAL
- Financial fraud potential = CRITICAL

E-commerce:
- Customer PII = HIGH/CRITICAL
- Payment processing = CRITICAL

SaaS/Cloud:
- Multi-tenant data exposure = CRITICAL
- Authentication bypass = CRITICAL

13. Ferramentas de Report

WorstAssume Export Commands

# Via dashboard web (worst viz)
# Click em "Export" → Select format (HTML/JSON/CSV)

# JSON export via CLI
worst privesc --from <arn> --output json > paths.json

# Graph export
worst graph-export --output graph.json

AWS CLI para Evidências

# Capturar evidências em formato estruturado
aws sts get-caller-identity --output json > evidence-identity.json
aws iam get-role --role-name <role> --output json > evidence-role.json

hping3 para Evidências de Network Testing

# Capturar output de scans para evidência
hping3 -S -p 80 -c 10 target.com 2>&1 | tee evidence-syn-scan.txt

# Documentar firewall mapping
hping3 -A -p 80 target.com 2>&1 | tee evidence-ack-scan.txt

# Salvar resultados de port scanning
hping3 -S -p 1-1000 --scan target.com 2>&1 | tee evidence-port-scan.txt

# Gerar relatório de IDS evasion testing
{
  echo "=== XMAS Scan Test ==="
  hping3 -F -P -U -p 80 -c 10 target.com
  echo ""
  echo "=== NULL Scan Test ==="
  hping3 -O -p 80 -c 10 target.com
  echo ""
  echo "=== Fragmented Packet Test ==="
  hping3 -S -p 80 -f -c 10 target.com
} | tee evidence-ids-evasion.txt

Template de Finding de Rede para Relatório (PTES 6.2)

# FINDING-NET-XXX: [Título do Finding de Rede]

## Metadados
- **Severity:** [CRITICAL/HIGH/MEDIUM/LOW/INFO]
- **Category:** NETWORK_VULNERABILITY
- **Tool:** hping3
- **CVSS Score:** [X.X]
- **Affected Host:** `target.com (IP)`
- **Portas/Services:** [lista]

## Descrição
[Descrição técnica da vulnerabilidade de rede identificada
através de scans com hping3.]

## Evidência (hping3 output)

HPING target.com (IP): S set, 40 headers + 0 data bytes <-- [output do hping3 capturado] -->

## Técnica Utilizada
- **Scan Type:** [SYN/ACK/XMAS/NULL/ICMP]
- **Flags:** [-S/-A/-FPU/-O/etc.]
- **Portas:** [range ou lista]
- **Evasion:** [fragmentation/spoofing/timing]

## Impacto
[Descrição do impacto se explorado, incluindo:
- Serviços expostos
- Possibilidade de lateral movement
- Risco de comprometimento de rede]

## Recomendação
[Passos específicos para remediar, incluindo:
- Configuração de firewall
- Regras de filtragem
- IDS/IPS tuning]

## Referências
- PTES 2.5.4 - Active Footprinting
- PTES 3.1.1 - Vulnerability Testing
- PTES 4.1.1 - Countermeasure Bypass

14. Report Writing com pentest-advisor Agent

Professional Report Structure (pentest-advisor)

EXECUTIVE SUMMARY Structure:
1. Engagement Overview (1 paragraph)
2. Overall Risk Rating (CRITICAL/HIGH/MEDIUM/LOW)
3. Key Findings Summary (3-5 bullet points)
4. Strategic Recommendations (prioritized)

TECHNICAL REPORT Structure:
1. Scope and Methodology
2. Detailed Findings (per vulnerability)
3. Attack Paths Discovered
4. Risk Matrix
5. Remediation Roadmap
6. Appendices (evidence, commands, references)

CVSS Scoring Integration (pentest-advisor)

Risk Assessment Framework:

Attack Vector (AV):
- Network (N): Vulnerability exploitable remotely
- Adjacent (A): Local network access required
- Local (L): Local access required
- Physical (P): Physical access required

Attack Complexity (AC):
- Low (L): No special conditions
- High (H): Specialized conditions required

Privileges Required (PR):
- None (N): No authentication needed
- Low (L): Basic user privileges
- High (H): Administrative privileges

User Interaction (UI):
- None (N): No user interaction
- Required (R): User action needed

Impact Metrics (C/I/A):
- None (N): No impact
- Low (L): Limited impact
- High (H): Complete loss

CVSS Score Calculation:
- 9.0-10.0: CRITICAL
- 7.0-8.9: HIGH
- 4.0-6.9: MEDIUM
- 0.1-3.9: LOW

Report Templates por Severidade

CRITICAL Finding Template:
┌─────────────────────────────────────────────────────────────────┐
│ FINDING: [Title]                                                │
│ SEVERITY: CRITICAL (CVSS: 9.X)                                  │
│                                                                 │
│ DESCRIPTION:                                                    │
│ [Clear explanation of the vulnerability]                        │
│                                                                 │
│ BUSINESS IMPACT:                                                │
│ - Complete system compromise                                    │
│ - Full data breach potential                                    │
│ - Regulatory implications (GDPR, HIPAA, PCI-DSS)                │
│                                                                 │
│ IMMEDIATE ACTION REQUIRED:                                      │
│ 1. [Specific remediation step]                                  │
│ 2. [Specific remediation step]                                  │
│ 3. [Specific remediation step]                                  │
│                                                                 │
│ TIMELINE: Remediate within 24-48 hours                          │
└─────────────────────────────────────────────────────────────────┘

HIGH Finding Template:
┌─────────────────────────────────────────────────────────────────┐
│ FINDING: [Title]                                                │
│ SEVERITY: HIGH (CVSS: 7.X-8.X)                                  │
│                                                                 │
│ DESCRIPTION:                                                    │
│ [Clear explanation of the vulnerability]                        │
│                                                                 │
│ BUSINESS IMPACT:                                                │
│ - Significant data exposure                                     │
│ - Privilege escalation possible                                 │
│                                                                 │
│ RECOMMENDED ACTION:                                             │
│ 1. [Specific remediation step]                                  │
│ 2. [Specific remediation step]                                  │
│                                                                 │
│ TIMELINE: Remediate within 7 days                               │
└─────────────────────────────────────────────────────────────────┘

15. Responsible Disclosure com bug-bounty-hunter Agent

Disclosure Timeline (bug-bounty-hunter)

Day 0: Submit report to program
Day 1-3: Initial triage (expect confirmation)
Day 7-14: Validation by security team
Day 30-90: Fix development and testing
Day 90+: Public disclosure (if agreed)

Communication Best Practices

DO:
✅ Be patient - security teams are often busy
✅ Be responsive - answer questions quickly
✅ Be collaborative - help validate fixes
✅ Be professional - maintain good relationships
✅ Follow program policies and scope

DON'T:
❌ Send constant status requests
❌ Share vulnerability publicly before fix
❌ Be rude or demanding
❌ Threaten to disclose
❌ Submit duplicate reports

Report Quality Checklist (bug-bounty-hunter)

Before Submitting:
□ Tested thoroughly
□ Clear reproduction steps
□ Proper security terminology
□ Remediation suggestions included
□ Professional tone
□ All relevant evidence attached
□ Checked for duplicates
□ Within scope

Report Structure:
□ Title: Clear and concise
□ Severity: Appropriate (CVSS if possible)
□ Description: What, where, how
□ Steps to Reproduce: Numbered, detailed
□ Impact: Business risk explained
□ Proof of Concept: Working payload
□ Remediation: Specific fix suggestions

Bounty Report Template

TITLE: [Vulnerability Type] in [Component] Allows [Impact]

SEVERITY: [Critical/High/Medium/Low]
CVSS: [Score if applicable]

SUMMARY:
[2-3 sentence overview of the vulnerability]

DESCRIPTION:
[Detailed explanation of the vulnerability]

STEPS TO REPRODUCE:
1. Go to [URL/endpoint]
2. [Action]
3. [Action]
4. Observe: [Result]

PROOF OF CONCEPT:
[Payload, screenshot, or video]

IMPACT:
[Explain business risk - data breach, account takeover, etc.]

REMEDIATION:
[Specific fix suggestions]

REFERENCES:
- [Relevant CVEs]
- [OWASP links]
- [Vendor documentation]

Platform-Specific Guidance

HackerOne:
- Use H1 report template
- Include CVSS calculation
- Follow program-specific guidelines

Bugcrowd:
- Use Bugcrowd Vulnerability Rating Taxonomy
- Include priority score justification
- Follow VRT severity levels

Intigriti/YesWeHack:
- European programs - GDPR considerations
- Clear business impact explanation

16. Entrega do Relatório

Formatos de Entrega

• PDF (formato principal para distribuição)
• HTML (versão interativa)
• JSON (para integração com SIEM/ticketing)
• CSV (para tracking em planilhas)

Distribuição

• Enviar para stakeholders principais
• Armazenar em local seguro (encrypted)
• Definir data de destruição do relatório
• Registrar recipients do relatório

Follow-up

• Agendar meeting de review
• Estabelecer timeline de remediation
• Oferecer re-test após correções
• Documentar lessons learned

Output Esperado desta Fase

1. Relatório executivo completo (PDF/HTML)
2. Dados estruturados de findings (JSON/CSV)
3. Attack paths documentados com evidências
4. Recomendações priorizadas de remediation
5. Apresentação para stakeholders

Fim do Processo PTES

Após completar esta fase, o penetration test está completo.

Referências PTES

• PTES Section 6: Reporting
• PTES 6.1: Executive-Level Reporting
• PTES 6.2: Technical Reporting
• PTES 6.3: Quantifying the Risk
• PTES 6.4: Deliverable

Ver Também

• /pentest-network-scanning - Section 14: OWASP Nettacker Integration (Network Scanning)
• /pentest-vulnerability-analysis - Section 7: OWASP Nettacker Vulnerability Scanning (CVE Detection)
• /pentest-intelligence-gathering - Section 9: OWASP Nettacker for Intelligence Gathering (Recon)
• /pentest-pfsense - Section 4.28: OWASP Nettacker for pfSense (Specialized Scanning)

🤖 AIRecon Integration for Reporting

NOTE: AIRecon can automate report generation, consolidate findings from multiple tools, and export in multiple formats.

AIRecon Invocation for Reporting

# Generate consolidated pentest report from all findings
airecon "generate pentest report from nettacker and worstassume findings"

# Export findings in specific format
airecon "export vulnerability findings to JSON for SIEM integration"

# Create executive summary from technical findings
airecon "create executive summary from pentest findings for management"

# Generate DefectDojo compatible report
airecon "export findings to DefectDojo format for vulnerability management"

Slash Command Integration

# Export API keys found during assessment for report
/ai airecon "/api-keys --export json > report-api-keys.json"

# Export webshell detection results for post-exploitation section
/ai airecon "/webshell-detect --export json > report-webshells.json"

# Generate wordlist usage statistics for methodology section
/ai airecon "/wordlist --stats --export markdown > report-wordlist-stats.md"

…(truncated)