Assessment tracking and documentation is a critical aspect of professional penetration testing. Each input and output from the testing tools should be recorded to ensure that the findings are reproducible in an accurate and consistent manner when needed. Keep in mind that part of the penetration testing process includes presenting the findings to clients. There is a high likelihood that these clients will want to mitigate the vulnerabilities and then attempt to mimic your steps in order to ensure their mitigations were effective. Depending on the scope, you may be required to perform additional testing that verifies that any improvements that the client makes actually remove the vulnerabilities you found. Accurate documentation of your steps will assist you in ensuring that the very same testing occurs during this follow-up.

Proper test documentation provides a record of the actions performed and thus allows you to trace your steps in case the client experiences non-test related incidents during your agreed-upon test window. Detailed recording of your actions can be very tedious, but as a professional penetration tester, you should not overlook this step.

Documentation, report preparation, and presentation are the core areas that must be addressed in a systematic, structured, and consistent manner. This chapter provides detailed instructions that will assist you in aligning your documentation and reporting strategy. The following topics will be covered in this chapter:

• Results verification, which ensures that only validated findings are reported.
• Types of reports and their reporting structures will be discussed from the executive, management, and technical perspectives, to best reflect the interests of the relevant authorities involved in the penetration testing project.
• The presentation section provides general tips and guidelines that may help in understanding your audience and their level of receptiveness to the given information.
• Post-testing procedures; that is, the corrective measures and recommendations that you should include as a part of a report, and their use in advising the remediation team at the organization concerned. This kind of exercise is quite challenging and requires an in-depth knowledge of the target infrastructure under security considerations.

Each of the following sections will provide a strong basis for preparing documentation, reporting, and presentation, and especially for highlighting their roles. Even a small mistake can lead to a legal problem. The report that you create must show consistency with your findings, and should do more than just point out the potential weaknesses found in a target environment. For instance, it should be well prepared and demonstrate a proof of support against known compliance requirements, if any, required by your client. Additionally, it should clearly state the attacker's modus operandi, applied tools, and techniques, and list the discovered vulnerabilities and verified exploitation methods. Primarily, it is about focusing on the weaknesses, rather than explaining the fact or procedure used to discover them.