Example Client Name Penetration Test Engagement Report

This Report Created for:

Client Name Here

Engagement Date:

Engagement Date Here

Testing Performed by:

Company Name Here

STOP!

THIS REPORT IS CONFIDENTIAL

This report contains sensitive information about Client Name Here and should be classified at their highest sensitivity level. Only those individuals that have a valid need to know should be allowed access to this report. Distribution should be limited to electronic formats which have password protection capabilities. Unauthorized viewing, distribution, or use of this report is prohibited.

If you have found this report, secure it until you are able to deliver it to the appropriate personnel.

Table of Contents

Executive Summary	4

Scope	4

Assessment Objectives	5

Risk and Exploits Definitions	6

Findings and Recommendations Overview	7

Positive Observations	8

Findings Details	9

Critical Risk Findings	9

C1 - Test Critical Risk Finding	9

High Risk Findings	10

H1 - Test High Risk Finding	10

Medium Risk Findings	11

M1 - Test Medium Risk Finding	11

Low Risk Findings	12

L1 - Test Low Risk Finding	12

Informational Findings	13

I1 - Test Informational Finding	13

Exploitation	14

E1 – Exploit Name Here	14

Appendix A: Methodologies	15

Executive Summary

Penetration and vulnerability testing begin with an information-gathering interview between Company Name Here and Client Name Here’s IT department personnel. The interview provides Company Name Here with a comprehensive understanding of Client Name Here’s information asset infrastructure and the best opportunity for appropriate initial consulting. The interview also provides Client Name Here a venue to discuss specific vulnerability concerns. Once the scope of testing is agreed upon, Client Name Here may further refine Company Name Here’s latitude and autonomy while conducting tests. Greater latitude produces a more organic process of discovery and will often result in a greater number of discoveries. All testing is conducted within the scope and latitude agreed upon in accordance with industry standards and best practices.

This section is intended to be used as an overview. Details have been omitted in order to allow the executive level reader to quickly assess what was done, how severe the findings are, and what an appropriate response should look like. Detailed findings, along with their proofs and suggested solutions can be found in section four of this report. Analysis of the findings can be found in section three.

Scope

On Engagement Date Here Company Name Here conducted a series of security tests (referred to as engagements) of Client Name Here’s information systems. Engagements are generally organic in nature and often overlap as vulnerabilities are discovered, exploited, and then leveraged to further compromise parts of the target systems or network.

At the request of Client Name Here, Company Name Here conducted an security assessment from 1/1/2000 to 2/2/2000, for the host(s)/range(s):

Assessment Objectives

The purpose of a Penetration Test is to assess Client Name Here’s information security posture and resilience to cyber-attacks. Company Name Here analyzes the available devices, hosts and applications, probing the hosts for vulnerabilities and exploiting the most vulnerable devices. If an attack results in a security breach of the Client Name Here information systems or applications, Company Name Here probes the additional network resources for vulnerabilities and further exploits the most susceptible devices.

The following table lists the categorized findings and associated risk ratings for this assessment. This table will allow Client Name Here to quickly determine the level of risk of the target and prioritize remediation efforts.

Risk Category	Total	Open Findings	Closed Findings
Critical Risk	1	1	0
High Risk	2	2	0
Medium Risk	3	3	0
Low Risk	4	4	0
Informational	5	5	0

Risk and Exploits Definitions

The risk associated with each finding is calculated using the Common Vulnerability Scoring System (CVSS). The CVSS attempts to assign a severity score to vulnerabilities, which is an assessment of the priority with which each risk will be viewed.

Risk Rating	Definition
Critical Risk	Exploitation of the technical or procedural vulnerability will cause substantial harm to business processes. Serious political, financial and legal damage is likely to result
High Risk	Exploitation of the technical or procedural vulnerability will cause substantial harm to business processes. Significant political, financial and legal damage is likely to result
Medium Risk	Exploitation of the technical or procedural vulnerability will significantly impact the confidentiality, integrity and/or availability of the system, or data. Exploitation of the vulnerability may cause moderate financial loss or public embarrassment
Low Risk	Exploitation of these technical or procedural vulnerabilities will cause minimal impact to operations. The confidentiality, integrity and availability of sensitive information are not at risk of compromise. Exploitation of the vulnerability may cause slight financial loss or public embarrassment
Informational	These findings are observations that were noted during the assessment that does not necessarily equate to a vulnerability
Exploits	Exploits are techniques that are used in order to gain unauthorized access to a given information resource or information system

Findings and Recommendations Overview

Implement and enforce change control across all information systems: Company Name Here found misconfiguration and insecure deployment issues were discovered across the various systems. The vulnerabilities that arose can be mitigated by using change control processes on all information systems.

Implement regular reviews of firewall rule set: Client Name Here should regularly review the firewall rules to ensure that all systems and applications open to Internet traffic continue to have a business need or justification to exist. Company Name Here recommends that NIST SP 800-417 be consulted for guidelines on firewall implementation, configuration and testing.

Implement a patch management program: Operating a strong patch management program per NIST SP 800-408 is an important component in maintaining a proper security posture. This will help Client Name Here to limit the attack surface that results from running unpatched services.

Conduct regular penetration tests and vulnerability assessments: As part of an effective organizational risk management strategy, penetration testing and vulnerability assessments should be conducted on a regular basis. Doing so will allow Client Name Here to determine if the current security controls are installed properly, operating as intended, and producing the desired outcome in ensuring proper Confidentiality, Integrity and Availability of Client Name Here information systems. Consult NIST SP 800-309 for guidelines on operating an effective risk management program.

Restrict network access to server management interfaces: Proper network segmentation will reduce exposure to internal attacks against the server environment. Operating a well-designed DMZ will allow Client Name Here to conduct its business in a manner that does not expose internal information systems to attack. Consult FIPS 19110 for guidelines on securing local area networks.

Positive Observations

Strong patch management: Company Name Here found that very few systems lack up-to-date patches which shows that effective patch management practices are being followed and are effective..

Hardened information systems: Client Name Here has implemented strong defense in depth practices that make it very difficult for an attacker to gain access to an information system etc etc.

Findings Details

This section lists the vulnerabilities discovered during the engagement(s). The individual findings are categorized according to severity (Critical, High, Medium, Low, Informational) and are listed under the corresponding subheading. The results of each finding are presented in table format for consistency and ease of use. The top row of each table is labeled with a sequential reference number and color-coded for easy reference and navigation. Each table provides the following information: the name of the vulnerability, if the vulnerability lead to exploitation, what system or systems are affected by it, a brief description, the evidence (usually a screen shot), and a recommended remediation strategy.

Critical Risk Findings

C1 - Test Critical Risk Finding
Exploited: No No
Affected Systems: https://testing.com/injecthere.php?vuln=test
Description: Operating system command injection vulnerabilities arise when an application incorporates user-controllable data into a command that is processed by a shell command interpreter. If the user data is not strictly validated, an attacker can use shell metacharacters to modify the command that is executed, and inject arbitrary further commands that will be executed by the server. OS command injection vulnerabilities are usually very serious and may lead to compromise of the server hosting the application, or of the application's own data and functionality. It may also be possible to use the server as a platform for attacks against other systems. The exact potential for exploitation depends upon the security context in which the command is executed, and the privileges that this context has regarding sensitive resources on the server.
Evidence: The following screenshot demonstrates the command injection vulnerability:
Recommendation: A simple If possible, applications should avoid incorporating user-controllable data into operating system commands. In almost every situation, there are safer alternative methods of performing server-level tasks, which cannot be manipulated to perform additional commands than the one intended.

High Risk Findings

H1 - Test High Risk Finding
Exploited: No No
Affected Systems: https://testing.com/injecthere.php?vuln=test
Description: Operating system command injection vulnerabilities arise when an application incorporates user-controllable data into a command that is processed by a shell command interpreter. If the user data is not strictly validated, an attacker can use shell metacharacters to modify the command that is executed, and inject arbitrary further commands that will be executed by the server. OS command injection vulnerabilities are usually very serious and may lead to compromise of the server hosting the application, or of the application's own data and functionality. It may also be possible to use the server as a platform for attacks against other systems. The exact potential for exploitation depends upon the security context in which the command is executed, and the privileges that this context has regarding sensitive resources on the server.
Evidence: The following screenshot demonstrates the command injection vulnerability:
Recommendation: A simple If possible, applications should avoid incorporating user-controllable data into operating system commands. In almost every situation, there are safer alternative methods of performing server-level tasks, which cannot be manipulated to perform additional commands than the one intended.

Medium Risk Findings

M1 - Test Medium Risk Finding
Exploited: No No
Affected Systems: https://testing.com/injecthere.php?vuln=test
Description: Operating system command injection vulnerabilities arise when an application incorporates user-controllable data into a command that is processed by a shell command interpreter. If the user data is not strictly validated, an attacker can use shell metacharacters to modify the command that is executed, and inject arbitrary further commands that will be executed by the server. OS command injection vulnerabilities are usually very serious and may lead to compromise of the server hosting the application, or of the application's own data and functionality. It may also be possible to use the server as a platform for attacks against other systems. The exact potential for exploitation depends upon the security context in which the command is executed, and the privileges that this context has regarding sensitive resources on the server.
Evidence: The following screenshot demonstrates the command injection vulnerability:
Recommendation: A simple If possible, applications should avoid incorporating user-controllable data into operating system commands. In almost every situation, there are safer alternative methods of performing server-level tasks, which cannot be manipulated to perform additional commands than the one intended.

Low Risk Findings

L1 - Test Low Risk Finding
Exploited: No No
Affected Systems: https://testing.com/injecthere.php?vuln=test
Description: Operating system command injection vulnerabilities arise when an application incorporates user-controllable data into a command that is processed by a shell command interpreter. If the user data is not strictly validated, an attacker can use shell metacharacters to modify the command that is executed, and inject arbitrary further commands that will be executed by the server. OS command injection vulnerabilities are usually very serious and may lead to compromise of the server hosting the application, or of the application's own data and functionality. It may also be possible to use the server as a platform for attacks against other systems. The exact potential for exploitation depends upon the security context in which the command is executed, and the privileges that this context has regarding sensitive resources on the server.
Evidence: The following screenshot demonstrates the command injection vulnerability:
Recommendation: A simple If possible, applications should avoid incorporating user-controllable data into operating system commands. In almost every situation, there are safer alternative methods of performing server-level tasks, which cannot be manipulated to perform additional commands than the one intended.

Informational Findings

I1 - Test Informational Finding
Exploited: No No
Affected Systems: https://testing.com/injecthere.php?vuln=test
Description: Operating system command injection vulnerabilities arise when an application incorporates user-controllable data into a command that is processed by a shell command interpreter. If the user data is not strictly validated, an attacker can use shell metacharacters to modify the command that is executed, and inject arbitrary further commands that will be executed by the server. OS command injection vulnerabilities are usually very serious and may lead to compromise of the server hosting the application, or of the application's own data and functionality. It may also be possible to use the server as a platform for attacks against other systems. The exact potential for exploitation depends upon the security context in which the command is executed, and the privileges that this context has regarding sensitive resources on the server.
Evidence: The following screenshot demonstrates the command injection vulnerability:
Recommendation: A simple If possible, applications should avoid incorporating user-controllable data into operating system commands. In almost every situation, there are safer alternative methods of performing server-level tasks, which cannot be manipulated to perform additional commands than the one intended.

Exploitation

E1 – Exploit Name Here
Applicable Findings:
Affected Systems: 10.1.1.1, 10.1.1.2, 10.1.1.3
Exploitation Walkthrough: During the assessment, Offensive Logic discovered that multiple systems are susceptible to the MS17-010 (EternalBlue) vulnerability. This allowed Offensive Logic to gain full privileged shell access to the system as the NT Authority / SYSTEM user. The following screenshot demonstrates the vulnerability being exploited and Offensive Logic gaining a meterpreter (Advanced shell interface) to the host:

Appendix A: Methodologies

External Network Penetration Testing

Offensive Logic follows an in-house developed methodology based on the Penetration Testing Execution Standard (PTES). At a high-level, our methodology is executed over the following phases:

Opensource Intelligence Information Gathering (OSINT)

Discovery and Enumeration

Vulnerability Scanning and Analysis

Vulnerability Exploitation

Post Exploitation Activities

Report Development

Post Engagement Consulting

Phase 1: Opensource Intelligence Information Gathering (OSINT)

Phase 1 begins with gathering information via Opensource information resources. These resources are commonly multiple search engines, online metadata gathering utilities, domain registrants, whois registrations and more. This phase is designed for discovery, to discern the presence of vulnerabilities and exploitation, all while remaining 100% stealthy.

Phase 2: Discovery and Enumeration

Phase 2 involves actual packets are sent to the network to discover live systems and any open ports, services that are exposed to the External network. This give the tester a view of possible applications and high levels vulnerabilities and exposures that may affect those hosts. This phase also involves the enumeration of banners, the application version strings of each exposed service, that may lead to clues on vulnerabilities affecting the host.

Phase 3: Vulnerability Scanning and Analysis

Phase 3 involves the automated and manual testing of the target hosts and services that were found during phase 2. This phase involves multiple open source and commercial tools to automatically analyze the presence of known vulnerabilities within the information system and the exposed service(s). Manual analysis is conducted on the target host that helps to both flush out any false positives that are discovered during the automated scanning efforts. Manual analysis is also conducted to find vulnerabilities that may have been missed by automation or issues that can only be discerned through human intelligence.

Phase 4: Vulnerability Exploitation

Phase 4 involves the exploitation of the discovered vulnerabilities in phase 3. During this phase denial of service conditions and vulnerabilities are NOT exploited but are documented in phase 6. Careful analysis and exploitation is performed using manual exploitation techniques and very little automation. Vulnerable network services, host-based services and web applications are targeted and exploited during this phase in order to achieve initial access to the target(s).

Phase 5: Post Exploitation Activities

Phase 5 involves the tactics, techniques and procedures to further gain access into the environment. This may include activities such as privilege escalation, lateral movements, additional enumeration, scanning and exploitation as outlined in phases 2-4, additionally key objectives may include obtaining domain or enterprise admin privileges and compromising an organization’s critical assets.

Phase 6: Report Development

Phase 6 is where the engagement deliverables are developed and additional testing may occur to ensure that proper evidences have been captured in order to prove risks and exposures of the network environment. Engagement deliverables are commonly in the form of report documents, PowerPoint presentations, and / or letters of attestation or opinion.

Phase 7: Post Engagement Consulting

Phase 7 involves the consultant(s) performing a walkthrough of the engagement deliverables and answering any question about the engagement and next steps. Additionally, any client feedback is noted and adjustments made to the final deliverable(s). Agreements in terms of retesting efforts are coordinates during this phase.

Internal Network Penetration Testing

Offensive Logic follows an in-house developed methodology based on the Penetration Testing Execution Standard (PTES). At a high-level, our methodology is executed over the following phases:

Discovery and Enumeration

Vulnerability Scanning and Analysis

Vulnerability Exploitation

Post Exploitation Activities

Report Development

Post Engagement Consulting

Phase 1: Discovery and Enumeration

Phase 1 involves actual packets are sent to the network to discover live systems and any open ports, services that are exposed on the Internal network. This give the tester a view of possible applications and high levels vulnerabilities and exposures that may affect those hosts. This phase also involves the enumeration of banners, the application version strings of each exposed service, that may lead to clues on vulnerabilities affecting the host.

Phase 2: Vulnerability Scanning and Analysis

Phase 2 involves the automated and manual testing of the target hosts and services that were found during phase 1. This phase involves multiple open source and commercial tools to automatically analyze the presence of known vulnerabilities within the information system and the exposed service(s). Manual analysis is conducted on the target host that helps to both flush out any false positives that are discovered during the automated scanning efforts. Manual analysis is also conducted to find vulnerabilities that may have been missed by automation or issues that can only be discerned through human intelligence.

Phase 3: Vulnerability Exploitation

Phase 3 involves the exploitation of the discovered vulnerabilities in phase 2. During this phase denial of service conditions and vulnerabilities are NOT exploited but are documented in phase 6. Careful analysis and exploitation are performed using manual exploitation techniques and very little automation. Vulnerable network services, host-based services and web applications are targeted and exploited during this phase in order to achieve initial access to the target(s).

Phase 4: Post Exploitation Activities

Phase 4 involves the tactics, techniques and procedures to further gain access into the environment. This may include activities such as privilege escalation, lateral movements, additional enumeration, scanning and exploitation as outlined in phases 1-3, additionally key objectives may include obtaining domain or enterprise admin privileges and compromising an organization’s critical assets.

Phase 5: Report Development

Phase 5 is where the engagement deliverables are developed and additional testing may occur to ensure that proper evidences have been captured in order to prove risks and exposures of the network environment. Engagement deliverables are commonly in the form of report documents, PowerPoint presentations, and / or letters of attestation or opinion.

Phase 6: Post Engagement Consulting

Phase 6 involves the consultant(s) performing a walkthrough of the engagement deliverables and answering any question about the engagement and next steps. Additionally, any client feedback is noted and adjustments made to the final deliverable(s). Agreements in terms of retesting efforts are coordinates during this phase.

Web Application Penetration Testing

Offensive Logic follows an in-house developed methodology based on the Open Web Application Security Project (OWASP) testing guide. At a high-level, our methodology is executed over the following phases:

Recon and Mapping

Vulnerability Discovery

Vulnerability Exploitation

Post Exploitation Activities

Reporting Development

Post Engagement Consulting

Phase 1: Recon and Mapping

Phase 1 begins with gathering information via Opensource information resources. These resources are commonly multiple search engines, online metadata gathering utilities, domain registrants, whois registrations and more. During this phase we also include the mapping of the target application by spending time getting to know all of its functionality, clicking on every link and submitting every request. Relationships between the application components are analyzed to determine how all of the application functionalities fit together, ultimately helping identify potential vulnerabilities.

Phase 2: Vulnerability Discovery

Phase 2 involves the automated and manual testing of the target application based on the content that was discovered in phase 1. Automated scanning and fuzzing of each parameter will be conducted during the vulnerability discovery phase to help the tester determine the presence of known and unknown vulnerabilities. Manual analysis will be conducted on the target application which will help discover vulnerabilities dealing with both the logic and overall design of the application. These types of issues are only discoverable through manual analysis and human intelligence.

Phase 3: Vulnerability Exploitation

Phase 3 involves the exploitation of the discovered vulnerabilities in phase 2. During this phase denial of service conditions and vulnerabilities are NOT exploited but are documented in phase 5. Careful analysis and exploitation are performed using manual exploitation techniques and very little automation.

Phase 4: Post Exploitation Activities

Phase 4 involves the tactics, techniques and procedures to further gain access into the application environment. This may include activities such as privilege escalation, lateral movements, additional enumeration, scanning and exploitation as outlined in phases 1-3.

Phase 5: Report Development

Phase 5 is where the engagement deliverables are developed and additional testing may occur to ensure that proper evidences have been captured in order to prove risks and exposures of the application(s). Engagement deliverables are commonly in the form of report documents, PowerPoint presentations, and / or letters of attestation or opinion.

Phase 6: Post Engagement Consulting

Phase 6 involves the consultant(s) performing a walkthrough of the engagement deliverables and answering any question about the engagement and next steps. Additionally, any client feedback is noted and adjustments made to the final deliverable(s). Agreements in terms of retesting efforts are coordinates during this phase.