Penetration Test Report Generator

About the Penetration Test Report Generator

Writing up a penetration test takes longer than it should: copying scanner output, scoring every finding, keeping IDs, tables and the executive summary in step. This generator does the assembly. Add findings with a title, a severity from the built-in CVSS 4.0 or 3.1 calculator (FIRST’s own scoring rules) or an OWASP Risk Rating, the affected assets, description, impact, steps to reproduce, evidence screenshots and text, remediation and references with CWE, OWASP Top 10 and WSTG links — or draft them from Nessus, Burp Suite, OWASP ZAP or Nmap exports.

The report builds itself as you type: a cover in your colours with your logo, a contents page with page numbers, document control, an executive summary with severity and retest charts, scope, methodology (OWASP WSTG, PTES), how risk was rated, a findings table and every finding in detail, with a retest appendix for follow-up. Findings you write well once can be saved to your own library on this device and reused. The free preview shows every page of the report as you build it; a Premium pass unlocks the DOCX, PDF, Markdown and CSV files.

It is meant for reports on testing you are authorised to do. Nothing you enter, open or import is uploaded.

Common uses

• Web application and API penetration test reports.
• Internal and external network assessments drafted from Nessus or Nmap.
• Vulnerability assessment reports for clients or auditors.
• Retest reports that show what was fixed.
• Bug bounty or internal security review write-ups in a consistent format.

What goes into the report

• Cover and contents: the engagement, client, version, dates and classification; contents with page numbers in the PDF (Word fills them in when the file opens).
• Document control and executive summary: your text, or a draft built from the findings you can edit; the overall risk and charts of findings by severity (and by retest result).
• Scope: what was in and out of scope, the approach (black, grey or white box), the testing period and any limitations.
• Methodology: the OWASP Web Security Testing Guide, the Penetration Testing Execution Standard (pentest-standard.org), your own method and the tools used.
• Risk ratings: the CVSS qualitative scale and, when used, the OWASP risk matrix.
• Findings: a summary table, then every finding with severity, score, status, affected assets, CWE weakness IDs, the OWASP Top 10 category, WSTG tests, vector, description, impact, steps, evidence, remediation and references; the CWE, Top 10 and WSTG entries link to their pages.
• Retest appendix, when you track retests.

Scoring

CVSS vectors are scored with the rules of FIRST’s reference calculators: v4.0 from its MacroVector lookup table and severity distances, v3.1 and v3.0 from their formulas, so the score matches what those calculators show. Paste a vector or build it metric by metric; v4.0 scores carry their nomenclature (CVSS-B, CVSS-BT, CVSS-BE, CVSS-BTE). The OWASP Risk Rating uses the same engine as the OWASP Risk Rating Calculator. A severity you choose yourself is marked as such in the report. Findings are numbered F-01, F-02 … by severity, or in the order you entered them.

Importing scanner results

• Nessus: export the scan as .nessus. Items are grouped by plugin across hosts; CVSS vectors in the file are used when present.
• Burp Suite: select the issues and choose Report selected issues, as XML. Issues of the same type are grouped, with the request and response as evidence.
• OWASP ZAP: the traditional XML report. Alerts keep their risk, CWE, solution and references, with the reported instances as evidence.
• Nmap: XML output (-oX), also of a scan that was stopped part-way. Each open service becomes an unscored draft listing the hosts; the Nmap Scan Viewer can send just the ports you tick.

Issues and alerts you marked as false positives in Burp Suite or ZAP are left out, and the import says how many.

Scanner text is a starting point: check every draft against your own testing, rescore it for the client’s environment and delete false positives before the report goes out.

Your findings library

When a finding is well written, choose Save to library: its title, scoring, CWE, Top 10, WSTG, description, impact, remediation and references are kept in this browser (never the client’s assets, evidence or retest notes). Insert it into the next report and adapt it. Export the library as a file to move it to another browser or share it with your team, and import theirs.

Limitations

• Only for testing you are authorised to do; the report records your scope and dates, not permission itself.
• Scanner drafts carry the scanner’s own wording and severity: they still need a tester’s review.
• Screenshots are kept only in the project file you save, not in the browser draft; save the project file before closing the page.
• The PDF uses Noto Sans for Latin, Greek and Cyrillic text; scripts that need shaping (such as Devanagari or Arabic) show as “?” in the PDF and in the free preview’s pages — use the DOCX for them.
• The Word table of contents is a field: Word fills in its page numbers when the document opens (other apps may need you to update it).

Privacy

Everything happens in your browser. Findings, screenshots and scanner files are never uploaded. Keep this report in this browser is off unless you switch it on, so client data is not left on a shared computer; your findings library stays in this browser until you clear it.