Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
You got domain admin in two hours, then spent three days writing. The three days are what the client paid for.
The Report Is the Product
You got domain admin in two hours, then spent three days writing. The three days are what the client paid for.
Structuring a Report
A pentest report has the same skeleton every time, and following it is what makes a stranger able to act on your work.
Writing a Finding
A finding a stranger can reproduce and fix is worth ten findings only you understand.
Rating Risk Honestly
If every finding is Critical, none of them are. Your severity ratings are only worth what your restraint makes them.
The Executive Summary
One page, no payloads, no CVE numbers. Written for the person who signs the check and will never read past it.