PhishRoot · Penetration Test Report · SAMPLE
Example Corp — External, Internal & Web Application Test
Example Corp is fictional. Findings are illustrative and do not describe any real client.
1. Executive summary
Testers obtained domain administrator access from a standard user foothold within the engagement window by chaining a weak service-account password with excessive privileges. Externally, the VPN lacked MFA and an API allowed customers to read other customers' invoices. All critical and high findings were escalated live and retested after remediation.
2. Risk overview
1
Critical
2
High
1
Medium
1
Low
3. Findings
| ID | Finding | Severity | CVSS |
|---|---|---|---|
| PR-01 | Domain admin reachable via Kerberoastable service account Asset: corp.example.internal Fix: Rotate the service account to a 30+ character managed password and remove domain admin rights. | Critical | 9.1 |
| PR-02 | Broken object-level authorization on /api/invoices/{id} Asset: app.example.com Fix: Enforce ownership checks server-side for every object lookup. | High | 8.1 |
| PR-03 | VPN portal accepts single-factor authentication Asset: vpn.example.com Fix: Require phishing-resistant MFA on all remote-access logins. | High | 7.5 |
| PR-04 | Public storage bucket exposes nightly backups Asset: s3://example-backups Fix: Block public access and enable default encryption with access logging. | Medium | 6.5 |
| PR-05 | Missing SPF hard-fail and DMARC enforcement Asset: example.com Fix: Publish DMARC p=reject after monitoring alignment. | Low | 3.7 |
4. Retest status
Real reports list each finding's retest result (fixed, partially fixed, open) with evidence and dates.