12 - Reporting & Cleanup

#Overview

The final phase of any penetration test is twofold: reporting your findings to the client in a clear, actionable format, and cleaning up every artifact, account, backdoor, and tool deployed during the engagement. A brilliant technical compromise means nothing if the client cannot understand the risk and remediate it. A clean network after your test is a non-negotiable professional obligation.

This phase is what separates amateur hackers from professional penetration testers.

#Report Structure

A penetration test report typically follows this structure:

#1. Executive Summary

• Audience: C-suite, non-technical stakeholders
• Length: 1-2 pages
• Content: High-level overview of the engagement, overall risk rating, key findings summary, business impact, and primary recommendations. No technical jargon. Use business language (e.g., "An attacker could access customer payment data" not "SQL injection in the checkout page allowed UNION SELECT extraction").

#2. Methodology

• Audience: Technical managers, IT leadership
• Content: The approach taken during the test. Reconnaissance, enumeration, exploitation, post-exploitation, and any constraints or scope limitations. Include tools and frameworks used (OSSTMM, PTES, OWASP). This section builds credibility by showing a structured, professional approach.

#3. Findings and Risk Ratings

• Audience: System administrators, developers, security engineers
• Content: Each vulnerability presented as a discrete finding with:
  • Finding ID / Title: Unique identifier and descriptive name
  • Risk Rating: Critical / High / Medium / Low / Informational (use CVSS or a consistent internal scale)
  • Description: What is the vulnerability, in plain English
  • Impact: What an attacker could achieve by exploiting this
  • Steps to Reproduce: Exact commands, URLs, and payloads used -- must be reproducible by the client's team
  • Evidence: Screenshots, console output, proof-of-concept code
  • Remediation: Specific, actionable steps to fix the vulnerability (not generic "patch your systems")

#4. Attack Narrative / Kill Chain

• Audience: Technical and management
• Content: A chronological walkthrough of the most significant attack path(s), showing how individual vulnerabilities were chained together to achieve compromise. This demonstrates the compounding risk of multiple findings.

#5. Remediation Roadmap

• Audience: IT leadership, project managers
• Content: Prioritized remediation actions organized by criticality and effort. Short-term (immediate patching, configuration changes), medium-term (architecture changes, tooling), and long-term (training, policy, process improvements) recommendations.

#6. Appendices

• Content: Full tool output, raw scan results, detailed network maps, compromised accounts list, all screenshots, and any additional supporting evidence.

#Cleanup Checklist

Every artifact created during the test must be removed. Use this checklist:

#Accounts and Credentials

#Files and Tools

#System Modifications

#Network and Connectivity

#Log Files (Client-Actionable)

#Verification

After cleanup, verify completeness:

1. Revisit each compromised host (if still accessible) and confirm no artifacts remain
2. Run the enumeration scripts again (winpeas, linpeas) and verify no findings were introduced by your testing
3. Check for lingering sessions: quser (Windows), who / w (Linux)
4. Review your notes: Cross-reference every file you created, account you added, and configuration you changed

#What's in This Section

#Cross-References

• All previous phases feed findings into this section. Every exploit, every credential captured, every lateral movement step, and every privilege escalation becomes a paragraph or finding in the report.

#Key Principle