20. Vulnerability Scanning and Assessment
20.7 Writing a Vulnerability Report
Report ha tumcha product aahe. Chaan report mhanje: manager la 1 page madhe samjel, aani engineer la fix karayla sagla mahiti milel.
Structure of a professional report:
| Section | Contents |
|---|---|
| Executive summary | 1 page, no jargon: overall risk, top 3 issues, what to do |
| Scope and method | Targets, dates, tools, what was out of scope |
| Findings summary | Table: ID, title, severity, affected host |
| Detailed findings | One block per finding (below) |
| Appendix | Raw scan files, tool versions |
One finding, written properly (lab example):
ID: MSF2-01
Title: vsftpd 2.3.4 contains a backdoor (CVE-2011-2523)
Severity: Critical (CVSS 9.8, verify on NVD)
Host/Port: 192.168.56.20 : 21/tcp
Evidence: nmap -sV shows "vsftpd 2.3.4"; ftp-vsftpd-backdoor script reports VULNERABLE
(screenshot 3)
Impact: A remote attacker can get a root shell without any password.
Fix: Remove vsftpd 2.3.4; install a current vsftpd from the OS repository
or disable FTP and use SFTP (SSH) instead. Restrict port 21 in the firewall.
References: https://nvd.nist.gov/vuln/detail/CVE-2011-2523
Why this matters for security
A scan finds problems, but only a clear report gets them fixed. Many real breaches used vulnerabilities that had been found earlier and never fixed because nobody understood the report or knew which issue came first.
Ravindra Bagale's Tip
Students write only "the system will be hacked" under "Impact". That says nothing! Write what will happen: "customers' phone numbers can be stolen" or "the website can go down". And under "Fix", give the exact step, not just "update it".
Ravindra Bagale's Tip – मराठी
Students "Impact" मध्ये फक्त "system hack होईल" लिहितात. हे काहीच सांगत नाही! लिहा – काय होईल: "customer चे phone numbers चोरीला जाऊ शकतात" किंवा "website बंद पडू शकते". आणि "Fix" मध्ये exact step द्या, नुसतं "update करा" नाही.
Ravindra Bagale's Tip – हिंदी
Students "Impact" में सिर्फ़ "system hack हो जाएगा" लिखते हैं. इससे कुछ पता नहीं चलता! लिखो – क्या होगा: "customers के phone numbers चोरी हो सकते हैं" या "website बंद हो सकती है". और "Fix" में exact step दो, सिर्फ़ "update करो" नहीं.
Lab
Write a short report on Metasploitable 2 using the structure above: a one-page executive summary, a findings table, and full detail for your top five findings. Save it as PDF – this is the kind of document you can show in an interview (it is your own lab, so it is safe to share).