Belajar Penetration Tester - Report Writing & Remediation

#Pendahuluan

Setelah di episode 16 kita mempelajari wireless & physical security — Wi-Fi attacks, RFID, dan physical assessment — pada episode ini kita membahas tahap terakhir dalam penetration testing yang seringkali paling diremehkan: report writing & remediation. Laporan adalah deliverable utama dari engagement — tanpa laporan yang baik, semua kerja teknis kalian kehilangan nilai.

Laporan pentesting harus dapat dibaca oleh dua audiens: eksekutif (yang memutuskan budget untuk remediation) dan technical team (yang melakukan remediation). Kalian harus mampu menjelaskan dampak bisnis dari kerentanan teknis.

#Struktur Laporan Pentesting

#Template Laporan

text

PENETRATION TEST REPORT
========================
 
1. Cover Page
   - Client name, date, engagement period
   - Classification: CONFIDENTIAL
 
2. Executive Summary (1-2 halaman)
   - Scope overview
   - Key findings (high-level)
   - Risk rating summary
   - Business impact
 
3. Methodology
   - Framework used (PTES/OWASP)
   - Testing period & tools
   - Scope & out-of-scope
 
4. Findings Detail
   - Per vulnerability:
     ├── Title & severity (CVSS)
     ├── Description
     ├── Affected systems
     ├── Proof of Concept (PoC)
     ├── Impact analysis
     └── Remediation steps
 
5. Remediation Roadmap
   - Priority matrix (critical → low)
   - Timeline recommendations
   - Resource requirements
 
6. Appendix
   - Tool output (Nmap, Nessus)
   - Detailed scan results
   - Glossary

#CVSS Scoring

#Common Vulnerability Scoring System (CVSS v3.1)

Metric	Value	Bobot
Attack Vector (AV)	Network/Adjacent/Local/Physical	Network = 0.85
Attack Complexity (AC)	Low/High	Low = 0.77
Privileges Required (PR)	None/Low/High	None = 0.85
User Interaction (UI)	None/Required	None = 0.85
Scope (S)	Unchanged/Changed	Changed = 1.0
Confidentiality (C)	None/Low/High	High = 0.56
Integrity (I)	None/Low/High	High = 0.56
Availability (A)	None/Low/High	High = 0.56

#Severity Levels

Score	Severity	Action
9.0-10.0	Critical	Immediate fix (24-48 jam)
7.0-8.9	High	Fix dalam 1 minggu
4.0-6.9	Medium	Fix dalam 1 bulan
0.1-3.9	Low	Fix dalam quarter
0.0	Info	Best practice improvement

#CVSS Calculator

text

Contoh: SQL Injection (unauthenticated, full database access)
 
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
= 9.8 (Critical)
 
Contoh: Reflected XSS (authenticated, limited impact)
 
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
= 5.4 (Medium)

Note

CVSS score hanya mengukur severity teknis. Selalu sertakan konteks bisnis — SQL injection di payment database lebih berdampak dibanding SQL injection di blog internal.

#Executive Summary

Executive Summary harus menjawab tiga pertanyaan:

Apa yang diuji? — Scope dan methodology
Apa yang ditemukan? — Key findings dalam bahasa bisnis
Apa dampaknya? — Business risk dan rekomendasi

#Contoh Executive Summary

text

Executive Summary
=================
 
Pada tanggal 1-15 September 2026, [COMPANY] melakukan penetration
testing terhadap website dan API PT Contoh Sejahtera. Testing
dilakukan menggunakan metodologi PTES dengan tools termasuk Nmap,
Burp Suite, dan Metasploit.
 
Hasil:
- 3 kerentanan CRITICAL ditemukan
- 5 kerentanan HIGH ditemukan
- 8 kerentanan MEDIUM ditemukan
- 12 kerentanan LOW ditemukan
 
Kerentanan CRITICAL memungkinkan penyerang untuk mengakses seluruh
database pengguna (termasuk password hash) dan melakukan SQL injection
pada payment endpoint. Tanpa remediation, risiko data breach
sangat tinggi dengan potensi kerugian est. $2-5M (regulatory fines
+ reputasi).
 
Rekomendasi: remediasi 3 CRITICAL dalam 48 jam, 5 HIGH dalam 1 minggu.

#Technical Detail

Setiap finding harus mencakup:

#Template Finding

markdown

## [CRITICAL] SQL Injection on Login Form
 
**CVSS Score**: 9.8 (Critical)
**CVSS Vector**: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 
### Description
The login form at https://app.target.com/login is vulnerable to
SQL injection. User input in the "username" field is directly
concatenated into a SQL query without sanitization.
 
### Affected Systems
- https://app.target.com/login
- Database: MySQL (production)
 
### Proof of Concept
1. Navigate to https://app.target.com/login
2. Enter `' OR '1'='1' --` in the username field
3. Enter anything in the password field
4. Click Login → redirects to dashboard (authenticated as admin)
 
### Impact
- Full database access (read/write)
- Bypass authentication
- Potential remote code execution via INTO OUTFILE
 
### Remediation
1. Use parameterized queries / prepared statements
2. Implement input validation (whitelist)
3. Apply least privilege to database user
4. Deploy WAF as temporary mitigation

#Remediation Roadmap

text

Priority Matrix
================
IMMEDIATE (24-48h):
  - CRITICAL: SQL injection on login
  - CRITICAL: RCE via file upload
 
SHORT-TERM (1 minggu):
  - HIGH: Broken authentication
  - HIGH: IDOR on user profiles
  - HIGH: XSS on search function
 
MEDIUM-TERM (1 bulan):
  - MEDIUM: Missing rate limiting
  - MEDIUM: Information leakage
  - MEDIUM: Insecure session management
 
LONG-TERM (quarter):
  - LOW: Missing security headers
  - LOW: Verbose error messages
  - LOW: Missing Content Security Policy

#Praktik: Tulis Laporan

Untuk setiap engagement yang sudah dilakukan di episode sebelumnya, buatlah:

Executive Summary (1-2 halaman)
Minimal 3 finding dengan CVSS scoring
Remediation roadmap

Simpan ini sebagai portofolio — klien potensial akan meminta contoh laporan.

#Penutup

Inti yang harus dibawa pulang:

Laporan: cover page, executive summary, methodology, findings, remediation roadmap, appendix.
CVSS v3.1: AV, AC, PR, UI, Scope, C, I, A → score 0-10 → severity rating.
Executive Summary: scope, key findings, business risk — dalam bahasa non-teknis.
Technical finding: description, affected systems, PoC, impact, remediation.

Di episode 18 selanjutnya, kita akan mempelajari red vs blue team & frameworks — bagaimana red team dan blue team berkolaborasi, MITRE ATT&CK, dan Cyber Kill Chain dalam konteks defensi.