How FAST Can You Write a Pentest Report?

Key Takeaways

all right Nick hey I'm super excited I think this is going to be very very cool looks like you got a vulnerable host you're beating up against hey something that can be compromised easy with eternal blue ms-17010 and uh I don't know man should we crank out a penetration test report for this I say we do we just pop the Box let's run the old school get uid so we're running this NT Authority system we've gotten into a box yeah let's try to do let's do a speed run of a pen test and try and use Plex track to get a pen test in uh in a set amount of time what do you think that would be super fun a little bit of a race hey I don't know some pressure quick on the fingers in the clock here I don't know do you think you could get this thing done in like five minutes or so maybe that's the goal five minutes or less wait I'll let you run my friend but I don't know I think Plex track is probably the right folks to be able to take up this challenge how fast can you crank out a penetration test report should I count you in my friend I mean give me a give me a three count let's do it all right sweet I got a stopwatch going let's do uh three two one the race is on all right so I'm in Plex track now I'm gonna hop in to our project uh demo and I'm gonna just create a report I'm going to select my template can give us some dates if I wanted to and we're gonna add some reviewers maybe assign it to some of my hacker Buddies now that I'm in the platform I've got my narrative set up let's start getting the hacks in there so I'm gonna do go work through it manually so we found the ms-1710 flaw I'm going to add a finding from our write-ups database which is basically like findings templates so you can go and Temple size your findings grab them add them into the platform uh now I'm gonna go and edit this finding and we're gonna take a look let's figure out what that asset was let's see Michelle well I just typed in Shell I can't hack there we go all right so we've got the IP let's go back into the platform and add it so I'm gonna say that uh we're gonna create I'm just gonna paste it in even though it's not a bunch of things you could paste one thing or a bunch of things here I'm gonna paste it in we could tag it I'm not gonna tag it so now we can also come into the platform and add our evidence so I'm just gonna screen grab this whole thing here say yeah this is my evidence of the hacks maybe I'll grab another screenshot of the other part here uh let's see we should just throw it here boom and we could throw some more evidence here as well this looks like some Sweet hacker nonsense we can add in all right so we've got our evidence we've added our finding that's pretty cool now let's also think about the rest of the pen test now we do a bunch of manual hacks and cracks but the reality is is you're going to be doing other things maybe you ran nessus maybe you have nmap maybe you have other tooling output let's just add some of that into so for a little bit of a hand wave we'll say that we ran a nest scan and we're jamming it into the platform now I can't fault you there I know hey we're right in the pen test report in five minutes we're not doing the pen test in five minutes Humanity there's folks out there who do pen tests in five minutes call it good so I am going to tag those and I'll show you why in a little bit and I'm gonna find this ms-1710 as well in here and I want to tag it as internal and uh I'll show you when we go generate the uh generate the finding later so now we've got our findings in the platform we can do all sorts of nonsense I can't really get into the the guts of what all we could do uh but you could come in you could add evidence to these like we did before you could have host you could collaborate so one of the things I like to show is the ability to as a peer reviewer during a pen test I can come in and I can add comments and I could do track changes and you know you get the whole maybe set the status say all right this is in process and uh edits have been made so now this uh we can collaborate it's nice especially if you're working on a gig with multiple people you can come in and say okay where were the edits made I can come in look for that finding all that fun stuff now we've come in we add our assets we add our data we do all sorts of hacking and Kraken we can then start to generate our report yeah you got a minute and a half left my friend I don't know what other Loose Ends we've got but let's run to the Finish Line all right now the report has been generated we can open it up and kind of walk through it oh it's on it's off screen let me drag it on screen and you can see so we've gotten our pen test report and maybe there's some things you need to do post processing maybe not um here's the output it's clean based on the sections that we selected when we did the selection we've got our methodology in those sections those short codes that you see here are placeholders you can in platform kind of find replace we've got all of the data we have and then we have our tables here we have our findings we have our detailed findings and we have our evidence nice and clean um obviously you can do a lot of different things but in five minutes or less I was able to come in manually add findings add in some scans get some data so just imagine your workflow when you're hacking and cracking and you want to be able to rapidly click button and finish a report I've got enough time to take a sip of coffee absolutely I definitely don't need well hey I look I know there are a couple things I don't know maybe left to do we got to crank out those short codes uh maybe clean up a little bit of title we'll asset name company name address but whatever like I don't think that's going to take more than a minute and 30 seconds if you're already cranking through you've got the contacts you've got the customer kind of filled out here uh absolutely so dang man actually to that point all of this data can also be pre-staged your logo uh customer logo the name of the report like I actually named the report report so this could be all queued up and ready to roll so there's really maybe one more once over or a lot of our folks's use case is just save it as PDF and ship it there is a lot of different things that you can do in the platform but you know working through the statuses being able to collaborate and then there's the con concept of having like the readout view so you've got that clean looking um document style report but here we could also work on a readout and be like hey here's the finding you know you've got the finding data here you could either be reading this out to your client or you could give the client an account they could log in and just you know digitally consume the information based on the results of the test because of the role-based access control and authorization so there's a lot of cool stuff you can do in the platform is that a lot of efficiencies is that common like do you see a lot of folks hey genuinely giving the customer the people that you're working with like hey come on in here's access to how we're helping yeah crank this up that's really really cool like Keys of the Kingdom a little bit that's awesome a significant number of folks are doing what we call digital delivery so they'll log in and what uh you know a lower privileged user because you can at the client level you can authorize user accounts so for each of the clients if you treat a client as maybe a business unit or a client as just a workspace you can authorize user accounts there and if they have read-only access when they log in they click into a report you know it's in draft status you can set it so that users can't even see it until it's published you can change the status to a published and then they see it you hold it back until you're ready for the user to log again when a user logs in their UI is going to look a little different they won't have like this and this they won't have edit capability but they can come in and change the statuses maybe ask for retesting maybe they come in and say Hey you know we're ready for retesting can you uh retest our finding that's awesome can they still see some of the analytics or absolutely oh man nope 100 the user role-based access control and authorization applies to analytics as well so when they log in they can create their own presets and if they want to know how many findings per report per quarter they want to look for specific cves or find uh you know I don't know and these sub statuses are all user customizable so I made these for like demo but you want to find all the open and in process statuses of cloud or appsec or something like that absolutely you could run in and look at all the analytics and get a lot of interesting data so that digital delivery Paradigm is pretty neat yeah I don't think we've ever got to talk about that before but like I love that I don't know maybe it's maybe it's nothing to like write home about for some folks but like I really really love the fact that you can be like oftentimes people that you work with and I think a service based business is like look what have you done for me lately what have you actually done how can you prove it um but being able to like literally put down your Shields and like look at look at this look at all this look at how the sausage is made I think that's really really cool uh it's funny because I recently did it's funny working at a report uh a platform that helps you with reporting I just did a talk called death to the document and it's the idea that look it's a it's a necessary evil folks need an artifact that's why we export to a bunch of different ways but we are actually trying to drive people into the digital delivery Paradigm and that's the that's the point of this View and the ability to come in and kind of be able to interact with findings you know everything you need as a consumer of Security Services is here you have the affected assets you have evidence if there is evidence you have the ability to work with the status right here so you could consume it in this fashion you could go and consume it and it starts filtering by tag searching for specific assets looking at the information here or you could go if you have specific hosts in mind in assets you could see the same data um kind of in the inverse you can look at specific hosts and find the findings related to those assets there's a lot of neat stuff you can do one of my favorite pieces of digital delivery is they actually the attack path so with the attack path you have the capability to take findings and observations and just create kind of a visual um relationship so that your consumers of your service when they log in they click on attack path they can see the findings that you think are related and so they can come in and say okay cool this finding these affected assets and they can get the context to it they can also interact with the finding based on their permission level right here then they can see that this is linked to this finding and then get the information and so you create this relationship and this visual kind of interactive visual can really be helpful to stakeholders to understand the impact of maybe chained uh flaws and vulnerabilities one last thing I totally want to dance with because I think it's very very cool because oftentimes I hear people always say like look you do a penetration test you do like some Vault assessment whatever you can take it to whatever scale you want but they always end up saying it's like at a static point in time and like especially with the document as you're saying just death to the document whatever stupid word doc or PDF it's a static thing uh but hey getting into the platform and again that digital delivery letting even the clients and customers come in there with you I feel like you've got this live Dynamic sort of updating in real time when you say look we're ready for a retest or we see a new finding that is really really cool collaboration on from every direction so hey man two thumbs up I love it much appreciated yeah that collaborative piece of the puzzle is neat because it's not just collaboration between practitioners who want to work together to get the evidence to get the report out that collaboration between provider of a service and consumer whether it's an internal Enterprise security team providing services to business units or it's uh you know a consultative pen testing organization providing to external organizations that collaboration is the key super cool well hey man I know we wanted to do a little bit of a speed run run the race say how fast can we crank out a penetration test report and man you did it like five minutes less than uh with still some time to to take the coffee break but look if we put out a if we put out a 15 minute people a video folks are gonna be like well I know it took 15 minutes not five so I want to be cognizant of your time but this was very very cool and uh thank you thank you thank you for the show and tell I'm glad you know hey we got through it we weren't sweating too hard that was fun indeed well thanks for having me been a blast cool we'll talk soon