🛠️Reporting Tips and Tricks
🎯 Overview
Professional reporting workflow requires templates, automation, and quality processes. Working on reports throughout assessments (not just at the end) ensures comprehensive documentation and prevents rushed deliverables with errors.
📋 Report Development Workflow
🔄 Work-As-You-Go Approach
# During assessment:
- Fill templated sections (contacts, scope, client info)
- Document attack chain in real-time
- Write findings with evidence immediately
- Maintain organized evidence collection
- Update credentials and artifacts continuously
# Benefits:
- No rushed final report
- Complete evidence capture
- Reduced QA issues
- Professional quality maintenance📝 Template Management
# Template requirements:
- Blank templates for each assessment type
- Never modify previous client reports
- Use placeholders for dynamic content
- Consistent formatting across team
- Regular template updates
# Risk mitigation:
- Avoid client name leakage
- Prevent data contamination
- Maintain professional appearance
- Ensure consistent quality🛠️ MS Word Professional Techniques
📊 Essential Features
# Font Styles (not direct formatting):
- Consistent heading styles
- Professional appearance
- Global change capability
- Reduced formatting errors
# Table Styles:
- Consistent table formatting
- Easy global modifications
- Professional presentation
- Reduced manual work
# Captions:
- Auto-renumbering capability
- Professional reference system
- Easy figure management
- Consistent presentation
# Navigation:
- Page numbers for collaboration
- Table of Contents for structure
- Bookmarks for hyperlinks
- List of Figures/Tables⌨️ Useful Hotkeys
# Productivity shortcuts:
F4 # Repeat last action
Ctrl+A, F9 # Update all fields (ToC, figures)
Ctrl+S # Save frequently
Ctrl+Alt+S # Split window view
Shift+F5 # Go to last revision
# Professional workflow:
- Use styles instead of direct formatting
- Create custom dictionary for common terms
- Set language settings for code blocks
- Configure Quick Access Toolbar🤖 Automation Strategies
📋 Macro Automation (Windows Word)
# Common macro applications:
- Client information insertion
- Template section removal
- Quality assurance checks
- Placeholder replacement
# Macro capabilities:
- Pop-up forms for data entry
- Automatic template customization
- Section removal via bookmarks
- Consistent formatting application
# Requirements:
- Save as .dotm files
- Windows environment (Mac VB Editor limited)
- VBA programming knowledge
- Testing and validation🗃️ Findings Database Tools
# Free options:
- Ghostwriter
- Dradis
- Security Risk Advisors VECTR
- WriteHat
# Paid solutions:
- AttackForge
- PlexTrac
- Rootshell Prism
# Benefits:
- Consistent finding quality
- Time savings
- Template management
- Team standardization📞 Client Communication
📧 Start/Stop Notifications
# Start notification content:
- Tester name and contact information
- Assessment type and scope description
- Source IP address for testing
- Anticipated testing dates
- Primary/secondary contact details
# Stop notification content:
- End of testing confirmation
- High-level findings summary
- Report delivery timeline
- Next steps communication🚨 Critical Finding Notifications
# Immediate notification triggers:
- Internet-exposed RCE vulnerabilities
- Unauthenticated sensitive data exposure
- Default/weak credential systems
- SQL injection on external applications
# Notification process:
- Stop testing immediately
- Formal vulnerability notification
- Client decision on proceeding
- Documentation of response💬 Ongoing Communication
# Professional dialogue:
- Additional scope discussions
- High-risk finding alerts
- System availability issues
- Domain compromise notifications
- Focus area adjustments
# Relationship building:
- Transparent communication
- Professional problem-solving
- Proactive client support
- Trust advisor approach🔍 Quality Assurance Process
📋 QA Checklist
# Content review:
- Technical accuracy verification
- Evidence completeness check
- Remediation recommendation quality
- Executive summary effectiveness
- Attack chain clarity
# Formatting review:
- Grammar and spelling check
- Consistent font usage
- Professional screenshot quality
- Proper redaction verification
- Style guide compliance👥 Review Process
# Minimum requirements:
- Author self-review (sleep on it)
- One external reviewer
- Preferably two QA rounds
- Technical and formatting separation
# Review standards:
- No self-review of own work
- Track Changes enabled
- Learning opportunity focus
- Professional development support📊 Professional Presentation Standards
📷 Screenshot Quality
# Requirements:
- Solid console backgrounds (not transparent)
- Professional themes (black/white, not colorful)
- Clear, readable text
- Proper cropping
- Professional hostnames/usernames
# Annotations:
- Arrows and boxes for clarity
- Explanatory text under screenshots
- Greenshot for professional editing
- Solid shapes for redaction (not blurring)💻 Terminal Output Standards
# Redaction guidelines:
- Remove unprofessional tool output (Pwn3d!)
- Clean up crude Hashcat candidates
- Redact all credentials and hashes
- Maintain technical accuracy
- Professional language only
# Presentation:
- Raw terminal text preferred
- Copy-paste friendly format
- Client reproduction capability
- Professional appearance🎯 HTB Academy Lab Practice
WriteHat Tool Access
# Lab environment:
# Browse to: https://TARGET_IP
# Credentials: htb-student:HTB_@cademy_stdnt!
# Practice activities:
1. Explore findings database
2. Practice report generation
3. Experiment with templates
4. Test evidence organization
5. Practice finding customization📝 Miscellaneous Best Practices
🎯 Storytelling Approach
# Report narrative:
- Connect findings to business impact
- Explain attack chain progression
- Demonstrate risk escalation
- Show interconnected vulnerabilities
- Justify severity ratings through context🔒 Data Protection
# Sensitive information handling:
- Redact credentials everywhere
- Remove password hashes
- Protect PII and sensitive data
- Consider report distribution scope
- Use solid shapes for redaction💾 Backup and Security
# Data protection:
- Auto-save configuration
- Regular backup procedures
- Multiple storage locations
- VM failure contingency
- Evidence preservation💡 Key Takeaways
Work-as-you-go prevents rushed final reports
Templates and automation ensure consistency and efficiency
Professional MS Word techniques improve document quality
Strong client communication builds trusted advisor relationships
Quality assurance process essential for professional deliverables
Evidence presentation standards affect report credibility
Continuous improvement through QA feedback and process refinement
Professional reporting combines technical expertise with clear communication, automation, and quality processes to deliver exceptional client value and maintain industry standards.
Last updated