20. Vulnerability Scanning and Assessment
20.7 Writing a Vulnerability Report
Report ha tumcha product aahe. Chaan report mhanje: manager la 1 page madhe samjel, aani engineer la fix karayla sagla mahiti milel.
Structure of a professional report:
| Section | Contents |
|---|---|
| Executive summary | 1 page, no jargon: overall risk, top 3 issues, what to do |
| Scope and method | Targets, dates, tools, what was out of scope |
| Findings summary | Table: ID, title, severity, affected host |
| Detailed findings | One block per finding (below) |
| Appendix | Raw scan files, tool versions |
One finding, written properly (lab example):
ID: MSF2-01
Title: vsftpd 2.3.4 contains a backdoor (CVE-2011-2523)
Severity: Critical (CVSS 9.8, verify on NVD)
Host/Port: 192.168.56.20 : 21/tcp
Evidence: nmap -sV shows "vsftpd 2.3.4"; ftp-vsftpd-backdoor script reports VULNERABLE
(screenshot 3)
Impact: A remote attacker can get a root shell without any password.
Fix: Remove vsftpd 2.3.4; install a current vsftpd from the OS repository
or disable FTP and use SFTP (SSH) instead. Restrict port 21 in the firewall.
References: https://nvd.nist.gov/vuln/detail/CVE-2011-2523
Why this matters for security
A scan finds problems, but only a clear report gets them fixed. Many real breaches used vulnerabilities that had been found earlier and never fixed because nobody understood the report or knew which issue came first.
Ravindra Bagale's Tip
Students "Impact" madhe fakt "system hack hoil" lihitat. He kahich sangat nahi! Lihaa – kay hoil: "customer che phone numbers chorila jau shaktat" kiwa "website band padu shakte". Aani "Fix" madhe exact step dya, nusta "update kara" nahi.
Lab
Write a short report on Metasploitable 2 using the structure above: a one-page executive summary, a findings table, and full detail for your top five findings. Save it as PDF – this is the kind of document you can show in an interview (it is your own lab, so it is safe to share).