3 ms·
Pentesting involves report writing 'cause you've got to tell people what you did somehow :) A better model (IMO) is for the pentester to get onboarded into the
by raesene9 5y ago
Pentesting involves report writing 'cause you've got to tell people what you did somehow :)
A better model (IMO) is for the pentester to get onboarded into the bug/defect tracking system and put things there. Pretty much every pentester I know would prefer this to writing long reports :P
- jacquesm 5y agoThose reports tend to be 90% boilerplate.
- raesene9 5y agoDepends hugely on the testing team and scope :) I've been a customer and tester over the years and I've seen everything from obvious scanner output, through to actually good bespoke content. There is going to be some boilerplate though, especially on lower price testing, that's one of the reason why testers would prefer just to file bugs.
- jacquesm 5y agoFair enough, there are exceptions.
- Sebb767 5y agoIt always depends on what your client knows. For most clients you could probably cut 30-70% of boilerplate, it's just that you don't know what. I've seen people who could exploit an unpatched Linux box in minutes but would have a hard time exploiting CRSF vulnerabilities and also the other way around. Of course, some people sell you a lot of paper for a lot of money, but even the good companies include a lot of you-know-if-you-can-skip-it boilerplate so that the client understands the report. At least that's my experience.