Types of Reports

Let’s look at the key parts of a Detailed Developer Report:

Index of all the vulnerabilities.
Information about what exact URL and parameters are affected.
The payload you used to confirm the vulnerability.
Observations (screenshots/videos) explaining a complete step by step exploitation of each vulnerability.
Outcome (if any) i.e. the data you were able to extract using the vulnerability, commands you were able to run, etc.
Business Impact - A detailed description of the impact of the vulnerability with examples (screenshots/videos).
Recommendations on how to patch the vulnerability.
References about the vulnerability, including links explaining the vulnerability, the patches and the impact.

Let’s look at the key parts of a High Level Management Summary:

Information summarising everything a hacker can do if an attack happens, containing maximum possible impacts of each vulnerability (multiple if they exist).
Information about what exact URL and parameters are affected.
Brief observations containing only the application affected and impact information i.e no step by step guide is required, but only outcome observations.
Detailed business impact with proofs of all kind of information you extracted during the exploitation.
References about the vulnerabilities (not the patches).

Last updated 1 year ago

Let’s look at the key parts of a Detailed Developer Report:

Index of all the vulnerabilities.
Information about what exact URL and parameters are affected.
The payload you used to confirm the vulnerability.
Observations (screenshots/videos) explaining a complete step by step exploitation of each vulnerability.
Outcome (if any) i.e. the data you were able to extract using the vulnerability, commands you were able to run, etc.
Business Impact - A detailed description of the impact of the vulnerability with examples (screenshots/videos).
Recommendations on how to patch the vulnerability.
References about the vulnerability, including links explaining the vulnerability, the patches and the impact.

Let’s look at the key parts of a High Level Management Summary:

Information summarising everything a hacker can do if an attack happens, containing maximum possible impacts of each vulnerability (multiple if they exist).
Information about what exact URL and parameters are affected.
Brief observations containing only the application affected and impact information i.e no step by step guide is required, but only outcome observations.
Detailed business impact with proofs of all kind of information you extracted during the exploitation.
References about the vulnerabilities (not the patches).

Last updated 1 year ago