CMU6XX

Ethical Hacking

Session 12: Pen-Testing Reporting & Ethics

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Master the structure and tone of a professional Penetration Test Report.
  • Translate highly technical vulnerabilities into business risk for C-suite executives.
  • Navigate the ethical dilemmas of zero-day discovery and disclosure.
  • Differentiate between Responsible Disclosure, Full Disclosure, and Coordinated Disclosure.
  • Understand industry certifications and career pathways (CREST, OSCP).

Seminar Structure (3 Hours)

Part 1: The Pentest Report (1.5 hrs)
  • Report Architecture & Target Audiences
  • Articulating Business Risk
  • Task 1: Executive Summary Drafting
Part 2: Ethics and Industry (1.5 hrs)
  • Responsible Disclosure vs Full Disclosure
  • Certifications (OSCP, CREST)
  • Task 2: Zero-Day Disclosure Simulation

Part 1: The Pentest Report

Duration: 1.5 Hours

The Only Deliverable

A client pays £20,000 for a penetration test. They don't buy your exploits; they buy a PDF.

  • If you compromise the entire domain but write a poor report, the engagement is a failure.
  • The report must cater to two completely different audiences simultaneously:
    • The C-Suite (CEO/CFO): Needs to understand business risk, financial impact, and ROI.
    • The Engineering Team: Needs exact reproduction steps, HTTP requests, and code-level remediation advice.

Report Architecture

A standard CREST-approved report structure:

  1. Executive Summary: High-level overview, non-technical risk assessment, and strategic recommendations.
  2. Engagement Scope & Methodology: What was tested, when, and how (PTES).
  3. Narrative (Attack Chain): A chronological story of how vulnerabilities were chained together to achieve the objective.
  4. Technical Findings: Detailed breakdown of each vulnerability, CVSS scores, Proof of Concept (PoC) screenshots, and remediation steps.

Articulating Business Risk

Engineers care about SQL Injection. CEOs care about bankruptcy.

  • Technical phrasing: "We achieved blind boolean-based SQL injection on the login endpoint."
  • Business phrasing: "A flaw in the login portal allows an unauthenticated attacker to extract the entire customer database, exposing the company to severe GDPR fines and catastrophic reputational damage."
Practical Resource: CREST Security Standards

Introduction to Task 1

Writing an Executive Summary requires turning off your "hacker brain" and turning on your "business consultant brain."

We will translate a deeply technical finding into an Executive Summary paragraph.

Task 1: Executive Summary Drafting

Timing: 45 minutes

During an engagement against a hospital's patient portal, you discovered a Server-Side Request Forgery (SSRF) vulnerability that allowed you to query the internal AWS metadata endpoint (169.254.169.254) and extract temporary IAM administrative credentials.

  1. Draft a one-paragraph Executive Summary of this finding. Ensure you clearly state the business impact without using any technical acronyms (No SSRF, AWS, IAM, IP addresses).
  2. Provide one strategic (non-technical) recommendation for the hospital board.

15 Minute Break

Please return promptly for Part 2.

Part 2: Ethics and Industry

Duration: 1.5 Hours

The Disclosure Dilemma

You find a zero-day vulnerability in widely used router firmware. What do you do?

  • Full Disclosure: Publishing the exploit code immediately to the public (e.g., Twitter, Exploit-DB). Forces the vendor to fix it instantly, but leaves users vulnerable to immediate attack.
  • Coordinated (Responsible) Disclosure: Privately notifying the vendor and giving them 90 days to issue a patch before you publish the details. The industry standard approach.
  • Non-Disclosure: Selling the exploit to a zero-day broker (like Zerodium) or a nation-state. Extremely lucrative, highly controversial.

The Hacker Ethic

The line between a security researcher and a cybercriminal is often defined by intent and authorization.

  • If you find an open database online and download a file to "prove" it was open, you have committed theft under the Computer Misuse Act.
  • Ethical hacking demands strict adherence to Rules of Engagement (RoE) and a commitment to doing no harm.
  • The goal is to improve the security posture of the target, not to demonstrate technical superiority.

Industry Certifications

How do you prove you can hack legally?

  • OSCP (Offensive Security Certified Professional): The gold standard entry-level cert. A brutal 24-hour practical exam where you must hack multiple machines in a lab environment.
  • CREST (Council of Registered Ethical Security Testers): The primary regulatory body in the UK. CREST certifications are often legally required to perform pentesting for government agencies.
  • CISSP: The gold standard for management and security architecture.

Introduction to Task 2

Navigating vendor relationships during a zero-day disclosure can be politically tense and legally risky.

We will draft a formal vulnerability disclosure communication.

Task 2: Zero-Day Disclosure Simulation

Timing: 50 minutes

You have discovered a critical authentication bypass in a smart-lock application used by millions of homes. You have found the security contact email for the vendor.

  1. Draft the initial outreach email to the vendor. Include a brief technical summary, but clearly outline your timeline for Coordinated Disclosure (e.g., 90 days).
  2. How should you securely transmit the Proof of Concept (PoC) code to the vendor? (Assume email is inherently insecure).
  3. If the vendor threatens legal action against you, what resources (e.g., EFF) and safe harbor principles can you invoke?

Module Conclusion

  • Ethical hacking is 50% technical mastery and 50% professional communication.
  • You now possess the foundational knowledge to perform vulnerability assessments, execute exploits, and articulate risk.
End of Module: CMU6XX Ethical Hacking