Chapter 8. Reporting and Conclusions
So far, we have analyzed the planning, discovery, and attack phases of wireless penetration testing. All these phases are equally important to achieve accurate and reliable results but need to be completed with the final phase, which is the reporting phase.
In this phase, all the information and findings that emerged from the penetration test are gathered and described in a report to be submitted to the customer.
The topics covered in this chapter are as follows:
In the next section, we will analyze the process of planning and writing a professional report.
The four stages of report writing
The reporting phase is often underestimated in its importance and considered as the boring, though necessary, part of a penetration test. Of course, the discovery and attack phases are the core and most exciting parts as it is when the penetration tester's technical skills are applied in practice. Penetration testers could be very skilled and might do an excellent job, but if they somehow fail to communicate their achievements to the customer effectively, their job is (at least in part) in vain.
Writing good reports is a required ability, almost an art, for penetration testers, and as for all the skills, can be improved through practice.
The process of writing a professional penetration test report comprises four stages:
In the first stage, report planning, we define the objectives, the target audience and the contents of the report, as well as the estimated...
In this section, we describe a typical format used to produce professional penetration testing reports.
Before writing the report, we must choose the look of the document; the fonts and the colors for the headings and the text, the margins, the header and footer content, and so on.
A report usually starts with a cover page that contains the report name and version, the date, the service provider, and the organization names. The service provider is the penetration tester or the penetration testing team. In the latter case, it is good practice to include the names of all the team members.
After the cover page, if the report is longer than a few pages, we should include a table of contents to list all the sections of the report with the page numbers.
The contents of the report can be grouped, as we have seen before, in two main sections: the executive summary and the technical report.
The executive summary, as the name suggests, is intended for the management...
In this chapter, we have covered the reporting phase of wireless penetration testing, analyzing each stage from the report planning to its review and finalization, and describing the typical format of a professional report.
The chapter also underlines the importance of effectively communicating the work done in the penetration test to the customer and a well-written and -presented report is certainly the best way!
We have arrived at the conclusion of our journey into wireless penetration testing. This is a very exciting branch of penetration testing that is rapidly evolving and will certainly be increasingly important in the future, thanks to the ubiquitousness of wireless networks and the wide growth of mobile devices.
Learning and mastering Kali Linux for wireless penetration testing not only provides us with a great set of tools to use but, as they are all open source, also gives us the opportunity to understand the logic of their implementation and of the attacks performed in depth.
