Pentest Reporting & Evidence Management

Supplementary Files:

• payloads.md — Command reference covering Dradis, Faraday, pipal, cutycapt, recordmydesktop, magictree, and cherrytree
• test-cases.md — Structured test case list covering report generation, evidence capture, password analysis, and data management

Summary

Pentest Reporting skill domain covering reporting operations.

Tools: dradis, faraday, pipal, cutycapt, recordmydesktop, magictree, cherrytree, Evidence Integrity (+11 more)

Domain: reporting

Use Cases

1. Collaborative Report Authoring — Use Dradis to centralize findings from multiple testers, attach evidence, and generate client-ready reports with consistent formatting
2. Vulnerability Management Platform — Import scan results from Nmap, Nessus, Burp, and other tools into Faraday for correlation, deduplication, and multi-project tracking
3. Automated Evidence Capture — Capture browser-based screenshots with cutycapt and record desktop sessions with recordmydesktop for reproducible, timestamped evidence chains
4. Password Audit Reporting — Analyze cracked password lists with pipal to identify patterns, generate statistics, and produce actionable remediation recommendations
5. Structured Data Organization — Use cherrytree and magictree to organize findings, attack trees, credentials, and notes in hierarchical, searchable structures
6. Client Deliverable Generation — Combine evidence from multiple sources into a polished final report with severity ratings, remediation steps, and compliance mapping

Core Tools

Tool	Purpose	Command Example
dradis	Collaborative reporting and findings management	dradis start && dradis resetProject
faraday	Multi-tool vulnerability correlation platform	faraday-server && faraday-client
pipal	Password pattern analysis and statistics	pipal cracked_passwords.txt --top 20
cutycapt	Headless browser screenshot capture	cutycapt --url=http://target --out=evidence.png
recordmydesktop	Desktop session video recording	recordmydesktop --output session.ogg --fps 15
magictree	Structured vulnerability data management	java -jar magictree.jar
cherrytree	Hierarchical note-taking and data organization	cherrytree

Methodology

Reporting Workflow

Evidence Collection     Findings Correlation     Report Authoring        Deliverable Generation
(Screenshots/Video/     (Faraday Import/         (Dradis/Magictree/      (PDF/DOCX/HTML Export
 Notes/Passwords)        Dedup/Priority)          Templates)              with Sanitization)
       |                      |                       |                        |
       v                      v                       v                        v
                Quality Review and Peer Validation
                (Sanitization/Formatting/Accuracy)

Phase Details:

1. Evidence Collection — Capture screenshots with cutycapt for web-based findings, record video demonstrations with recordmydesktop for complex exploit chains, and document all observations with timestamps in cherrytree
2. Findings Correlation — Import results from all scanning and exploitation tools into Faraday for automatic deduplication, severity normalization, and host-based correlation. Use magictree for structured attack tree documentation
3. Report Authoring — Use Dradis to compose findings with evidence attachments, assign severity ratings with CVSS scores, and apply report templates that match the client's expected format
4. Deliverable Generation — Export reports in multiple formats (PDF, DOCX, HTML), apply sanitization to remove real IPs and credentials, and generate password audit statistics with pipal for credential-related findings

Defense Perspective

Best Practice	Description	Priority
Evidence Integrity	Timestamp and hash all evidence files to maintain chain of custody	CRITICAL
Sanitization	Replace all real IPs, domains, and credentials with documentation-safe values before delivery	CRITICAL
Reproducibility	Include exact commands, tool versions, and environment details so findings can be verified	HIGH
Consistent Formatting	Use templates and style guides to ensure all findings follow the same structure	HIGH
Severity Calibration	Apply CVSS scoring consistently and cross-validate with team members	MEDIUM
Structured Organization	Use hierarchical tools (cherrytree, magictree) to keep findings searchable and linked	MEDIUM

Practical Steps

Step 1: Set Up Reporting Infrastructure

Initialize Dradis for collaborative report authoring and Faraday for vulnerability correlation before testing begins. Configure project structures and import templates.

Step 2: Capture Evidence During Testing

Use cutycapt for automated web screenshots, recordmydesktop for exploit demonstrations, and cherrytree for real-time note-taking. Maintain consistent naming conventions for all evidence files.

Step 3: Correlate and Deduplicate Findings

Import all tool outputs into Faraday for automatic deduplication and host correlation. Use magictree to build structured attack trees that show the relationship between findings.

Step 4: Analyze Password Audits

Run pipal against cracked password lists to identify patterns (common bases, complexity distribution, top passwords). Include results in the deliverable with remediation recommendations.

Step 5: Generate and Deliver Report

Compose the final report in Dradis, attach all evidence, apply sanitization, and export in the client's preferred format.

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Detection Methods

Report Quality Metrics

• CVSS accuracy: Reported CVSS matches calculated CVSS v3.1/v4.0.
• Remediation verification: All "fixed" findings verified by re-test.
• False positive rate: <5% of reported findings are false positives.

SIEM Detection Rules

• Custom tracking: Jira / GitHub Issues integration for finding lifecycle.

Defense Evasion Techniques

Operational Security for Testers

• Stay in scope: Don't access systems outside engagement letter; preserves legal protection.
• Document everything: Maintain detailed audit trail; demonstrates authorization.
• Notify client of high-risk findings immediately: Don't wait for final report for critical issues.

Report Quality

• Verify findings: Independent reproduction before reporting.
• Provide actionable remediation: Don't just identify problems; suggest concrete fixes.
• Map to MITRE ATT&CK: Use standardized framework for cross-org understanding.

Common Pitfalls

• Delaying evidence capture: Trying to reproduce findings after the engagement ends often fails because environments change or are patched. Capture screenshots, video, and notes in real-time during testing — every finding should have evidence attached within minutes of discovery.
• Skipping deduplication: Running multiple scanners without correlating results produces inflated finding counts that erode client trust. Always import into Faraday or a similar platform to merge duplicates before including in the report.
• Inconsistent severity ratings: Different team members applying different severity criteria for similar findings undermines report credibility. Establish a CVSS-based rubric at the start of the engagement and cross-validate all ratings.
• Poor password audit reporting: Simply listing cracked passwords without pattern analysis provides no actionable guidance. Use pipal to identify systemic weaknesses (common bases, missing complexity rules) that drive remediation policy changes.

Automation and Scripting

Automate the reporting pipeline by chaining Faraday's API for findings import and deduplication, then pushing correlated results to Dradis via its REST API for report generation. Use cutycapt in batch mode to screenshot every confirmed vulnerable endpoint, and wrap pipal in a script that generates both raw statistics and executive-friendly summary charts. Cherrytree's XML storage format enables programmatic extraction of structured notes for integration into the final deliverable.

Integration with Other Skills

Pentest reporting sits at the end of every engagement workflow. Network pentest and web application testing skills feed their raw outputs into Faraday. The article-writing skill provides the report structure templates and writing methodology, while pentest-reporting supplies the tooling for evidence management, findings correlation, and collaborative authoring. Post-exploitation and privilege escalation findings require particularly detailed evidence chains that cutycapt and recordmydesktop provide.

Tool Comparison Matrix

Tool	Best For	Collaboration	Input Formats	Skill Level
Dradis	Report authoring and templating	Multi-user	Manual + plugins	Intermediate
Faraday	Vulnerability correlation and tracking	Multi-user	100+ tool formats	Intermediate
Pipal	Password pattern analysis	Single-user	Text files	Beginner
CutyCapt	Web screenshot evidence	Single-user	URLs	Beginner
recordmydesktop	Session video recording	Single-user	Screen capture	Beginner
MagicTree	Structured vulnerability data	Single-user	XML, CSV, tool output	Advanced
CherryTree	Hierarchical note organization	Single-user	Rich text, code, images	Beginner

Learning Resources

This skill's supplementary files: payloads.md, test-cases.md

Related skills:

• skills/article-writing/SKILL.md - Report writing methodology and templates
• skills/engagement-manager/SKILL.md - Engagement scoping and deliverable management
• skills/password-attack/SKILL.md - Password cracking tools that feed pipal analysis

Guides in this skill:

• guides/dradis-faraday-reporting.md - Dradis and Faraday reporting workflows
• guides/evidence-collection.md - Evidence capture and chain of custody
• guides/password-audit-reporting.md - Password audit analysis and reporting