An example of an enterprise penetration test report

Throughout this book, we will build a secure design for an event ticketing system. Envision a software system that allows a box office or a website to sell tickets to a famous musical concert or theatre event. A simplified sample penetration test report is detailed in the following:

High-level summary

A workstation, web server, and database server were analyzed. The workstations were found to be vulnerable if malware was installed. The malware may be able to modify and read the API calls. The web server had some common web vulnerabilities, which are included in the Vega report. The database server had a single potential SQL injection vulnerability. The recommendations are included in the following individual host analysis section. Periodic scanning of the web and database servers is included in the recommendations.

Host analysis

This section of the report will document the reconnaissance, vulnerability analysis, exploitation...