Pentest Finding Templates, Written Up and Ready to Use
490 findings written up as a report would carry them, across 21 areas, each with a description that covers its impact, the remediation, CVSS 3.1 and 4.0 ratings, CWE, ATT&CK techniques and references.
Every firm writes SQL injection, Kerberoasting and a missing HSTS header many times over. The finding library is 490 findings written up the way a senior tester would put them in a client report, across 21 areas from web applications and APIs to Active Directory, cloud, containers, mobile, wireless and AI applications. It is a starting point for your own library: add what you write most, then make it yours.
What each finding carries
| Field | What it holds |
|---|---|
| Description | what the weakness is, what an attacker could realistically do with it and what makes that worse or better, and how testing shows it, in the present tense, with no host, client or version that would only be true of one test |
| Remediation | the fix, the most important step first, naming the setting, header, policy or code pattern, with a configuration example where it helps |
| Ratings | a CVSS 3.1 and a CVSS 4.0 vector for the typical case, each with its score, and the severity the score decides |
| CWE | the one weakness that best names the root cause, linked to MITRE’s page |
| MITRE ATT&CK | the techniques the weakness directly gives an attacker |
| References | the guidance that helps a client fix it, such as the OWASP cheat sheets and the vendor’s own documentation |
| Scanner titles | the names scanners give the issue, so the scanner import recognises it |
The text is written in British English, and generic by design: it reads correctly for any client where the issue is found, so a tester adds the specifics around it rather than editing them out.
Where it is
It is Settings, Library, beside Findings, and on the Library page as a second shelf, Finding library, beside Your library. A firm whose own library is empty opens on it.
Finding what you need
- Search matches the title, the summary, the CWE, the category, the area, ATT&CK technique IDs, CVEs and the words a tester would type: Kerberoasting, CWE-79, HSTS and S3 all find what you would expect.
- An area narrows it to one of the areas, and a severity to one band, rated in the CVSS version your firm uses.
- Preview shows everything before you add it: both ratings with their vectors, the CWE, the category, the OWASP Top 10:2025 category the CWE falls in, the ATT&CK techniques by name, the text and the references.
Adding to your library
Add to my library on a card, or in a preview, copies the finding into your own library. Above the cards, Add these, with the number shown, to my library adds every finding the search and filters show that you do not have yet.
- The copy is rated in your firm’s CVSS version: a firm that scores in CVSS 4.0 gets the 4.0 vector, score and severity.
- Its category is one of your own categories, left empty where your list has none like it, and its references start with the CWE page.
- It keeps the titles scanners give the issue, so a later scan import brings those results in under your entry, in your words.
- A finding you already have, by the entry it came from or by the same title, shows In your library, with Open, and is never added twice.
Your copy is yours. Change the wording to your house style, rescore it, add your own fields: nothing in the finding library ever writes over it.
For how your own library is used in an engagement, see the findings library, and for how the finding library brings scanner results together, deduplicating scanner results. For keeping a library your team actually uses, see building a findings library.
Start Your Library from the Finding Library
Open Settings, Library on the trial, search for the findings you write most often and add them to your own library in one go.
Only need the reporting? Our reporting tool is free and open source, on your own server.
Also Worth Reading
Making Your Word Template the One Pental Fills
Settings, PDF & DOCX, Open the Document Builder. Drop in a document you already send: with an AI connected the build starts at once, shows its stages, and ends on a card where you check it, preview the pages and save.
ReportingFixing a Template That Renders Inconsistently
Nearly every rendering complaint traces to formatting applied to the paragraph instead of held on a style. Word hides the difference from you; anything reading the file can see nothing else.
ReportingThe Findings Library: Write a Finding Once, Reuse It
Your firm’s own reusable findings, on from the start. Add a finding from the finding itself, in bulk or automatically once it is final, and bring the agreed wording into any engagement.
Setup guide
Prefer to watch it?
The whole setup recorded, with chapters you can jump to: registering, your own domain, your own database in any of three places, your own mail server, branding, the first sign-in, updating the database on Supabase Cloud, and moving the database if you change your mind.
- 0:00 · Registering, signing in, and the free trial
- 0:44 · Your name and your firm’s name
- 0:50 · Custom domain
- +6 more