PNPT Report Writing Guide
10 min readMar 8, 2026
This is a report writing guide for TCM Security’s PNPT (Practical Network Penetration Tester) certification exam.
Even if you successfully compromise the Domain Controller, failing to produce a quality report means failing the exam.
Passing candidate reviews repeatedly mention “I failed my first attempt because of the report.”
[Report Writing Workflow]
The goal in report writing is to document the entire penetration test in a way that both technical and non-technical readers can understand.
[Domain Controller compromised]
Step 1. Design Report Structure
Build around the TCM Security sample report template
Verify all sections and fill in missing screenshots
Step 2. Write Executive Summary
Non-technical summary for C-level executives
Overview of findings, security strengths and weaknesses
Step 3. Write Technical Findings
Document each vulnerability in its own detailed section
Order: Critical → High → Medium → Low → Informational
Step 4. Write Attack Chain
Narrative from OSINT → external pentest → internal network → DA
Full attack flow with supporting screenshots
Step 5. Write Remediation Recommendations
Specific fixes for each identified vulnerability
Step 6. Review & Submit
Final check for typos and missing screenshots
[Report submitted → 15-minute debrief → Pass / Fail][TCM Security Sample Template]
TCM Security publishes an official sample report template on GitHub.
Passing candidates consistently say they used or referenced this template.
※ TCM Security Sample Template: https://github.com/hmaverickadams/TCM-Security-Sample-Pentest-Report
Full Report Structure:
[Cover Page]
Client name, report title, date, author, confidentiality classification[Table of Contents]
Include page numbers[1] Disclaimer
- This test represents a point-in-time snapshot
- Only vulnerabilities found within the engagement period are included
- No liability for new vulnerabilities discovered after testing ends[2] Assessment Overview
- Based on NIST penetration testing methodology
- Pentest lifecycle (Reconnaissance → Scanning → Exploitation → Post-Exploitation → Reporting)[3] Assessment Components
- Description of External Penetration Test
- Description of Internal Penetration Test / AD attacks[4] Findings Severity Summary
- CVSS v3-based severity classification table
- Total vulnerability count / severity breakdown chart[5] Scope
- List of in-scope IPs / domains
- Out-of-scope items (DoS, Social Engineering, etc.)
- Client-provided resources[6] Executive Summary
- Written in non-technical language
- Testing period and scope
- Security strengths / security weaknesses
- Vulnerability count chart by severity[7] Technical Findings
- Detailed section for each vulnerability (Critical → Informational)[8] Attack Chain
- Full attack flow narrative[9] Appendix
- Tools used
- References
[Step 1: Cover Page & Table of Contents]
The goal in this phase is to create the cover page that forms the first impression of your report, and a navigable table of contents.
Writing Example:
[Cover Page]Report Title : Internal and External Network Penetration Test
Findings Report
Client : Acme Corp
Author : [Your Name]
Date : March 5, 2025
Classification: CONFIDENTIAL--------------------------------------------------------------------[Table of Contents]Use the automatic table of contents feature in Word / LibreOffice
- Assign Heading 1 / Heading 2 styles to each section, then auto-generate
- Page numbers are mandatory
- Update the table of contents after all sections are complete
[Step 2: Disclaimer]
The goal in this phase is to define the limits and scope of liability for the test to prevent legal disputes.
Writing Example:
This report documents the results of a penetration test conducted
from [start date] to [end date].This assessment represents a point-in-time snapshot. We accept no
responsibility for vulnerabilities that emerge or change after the
conclusion of the testing period.Only vulnerabilities discovered within the contracted scope are
included in this report. Due to time constraints, we cannot
guarantee that all vulnerabilities have been identified.
[Step 3: Assessment Overview]
The goal in this phase is to explain what penetration testing is and which methodology was followed.
※ Methodology selection is flexible as long as it complies with the RoE document’s scope and exclusions (PTES, OWASP Testing Guide, NIST SP 800–115, etc.).
Writing Example:
This assessment was conducted in accordance with the NIST SP 800-115
Technical Guide and consisted of the following phases:1. Reconnaissance - Collection of open-source and target system information
2. Scanning - Port and service enumeration
3. Exploitation - Vulnerability exploitation and initial access
4. Post-Exploitation - Lateral movement and privilege escalation
5. Reporting - Documentation of findings and remediation guidance[Step 4: Assessment Components]
The goal in this phase is to clearly specify what types of testing were performed.
Writing Example:
This assessment consisted of the following two components:External Penetration Test
Externally accessible services were assessed for initial access
vectors and the potential to gain entry into the internal network.Internal Penetration Test
Following internal network access, the Active Directory environment
was assessed for lateral movement, privilege escalation, and
Domain Controller compromise.
[Step 5: Findings Severity Summary]
The goal in this phase is to present all discovered vulnerabilities at a glance, organized by severity.
※ Severity can be determined using the CVSS calculator or your own professional judgment.
Writing Example:
[CVSS v3 Severity Criteria]Critical (9.0 – 10.0) : 2 findings
High (7.0 – 8.9) : 3 findings
Medium (4.0 – 6.9) : 2 findings
Low (0.1 – 3.9) : 1 finding
Info (0.0) : 1 finding
------------------------------
Total : 9 findings--------------------------------------------------------------------[Severity Determination Criteria]Severity is determined by calculating a CVSS v3 score based on
Likelihood and Impact.- Likelihood: Attack complexity, authentication requirements,
availability of public exploits
- Impact: Scope of Confidentiality (C), Integrity (I),
and Availability (A) compromise
※ Inserting a pie chart or bar chart in Word / LibreOffice lets reviewers assess the situation at a glance — a definite plus.
[Step 6: Scope]
The goal in this phase is to clearly document what was tested and what was excluded.
Writing Example:
[In-Scope]IP / Domain Description
-----------------------------------------
10.10.10.0/24 Full internal network
192.168.1.50 External web server
target.com External domain--------------------------------------------------------------------[Out-of-Scope]- DoS / DDoS attacks
- Social Engineering (employee phishing, etc.)
- Physical security testing
- Any systems outside the IPs/domains listed above--------------------------------------------------------------------[Client-Provided Resources]- None (black-box test)
OR
- VPN access credentials provided
- One internal user account provided (grey-box test)
[Step 7: Executive Summary]
The goal in this phase is to write a summary that allows a C-level executive with no technical background to grasp the full situation within 10 minutes.
Writing Structure:
[Test Overview]Example:
"At the request of [Company Name], an external and internal network
penetration test was conducted from [date] to [date]. The purpose
of this assessment was to identify security vulnerabilities in
[Company Name]'s network infrastructure and provide remediation
guidance."--------------------------------------------------------------------[Testing Summary]- What attacks were performed (without naming specific tools)
- What was discovered (focus on High / Critical findings)
- What was obtained (Domain Admin access, etc.)Example:
"During the assessment, credential vulnerabilities were identified
in external-facing services, enabling access to the internal network.
Following internal network entry, the complete Active Directory
environment — including the Domain Controller — was fully compromised."--------------------------------------------------------------------[Security Strengths]- Mention what was done well (firewall config, some patches applied, etc.)
- If there are none, say so — but don't leave this section entirely blank--------------------------------------------------------------------[Security Weaknesses]- MFA not enforced
- Weak password policy
- No account lockout threshold
- Unpatched systems
- Insufficient internal network segmentation
※ The Executive Summary must be readable by someone with no technical background.
※ Instead of “SMB Relay Attack,” write “network traffic interception attack.”
[Step 8: Technical Findings]
The goal in this phase is to document each discovered vulnerability in a reproducible, verifiable format.
Vulnerabilities must be ordered: Critical → High → Medium → Low → Informational.
Get jaejun835’s stories in your inbox
Join Medium for free to get updates from this writer.
Each vulnerability follows this format:
[Vulnerability Title] e.g., LLMNR Poisoning
Severity: Critical
CVSS Score: 9.8--------------------------------------------------------------------[Description]LLMNR (Link-Local Multicast Name Resolution) is a protocol used to
resolve hostnames on the local network when DNS lookup fails.
An attacker can respond to these requests to capture NTLMv2 hashes
from victims on the network.--------------------------------------------------------------------[Impact]An attacker can obtain NTLMv2 hashes from domain users on the
internal network. Captured hashes can be converted to plaintext
passwords via offline cracking, or used directly in Pass-the-Hash
attacks to authenticate to other systems without credentials.--------------------------------------------------------------------[Steps to Reproduce]1. Run Responder on the attacker machine
2. A victim on the internal network attempts to access a
non-existent host
3. Responder intercepts the LLMNR query and captures the NTLMv2 hash
4. Crack the hash offline with hashcat[Screenshot — Responder hash capture]
[Screenshot — hashcat cracking success]--------------------------------------------------------------------[Remediation]1. Disable LLMNR via GPO
Computer Configuration → Administrative Templates
→ Network → DNS Client → Turn off multicast name resolution: Enabled
2. Disable NBT-NS
3. Enforce a strong password policy to increase hash cracking difficulty
[8–2: Screenshot Requirements]
Screenshots that must be included:
1. Initial Access
- Reverse shell obtained (with whoami output)2. Each Vulnerability Exploited
- Hash capture, credential theft, code execution, etc.3. Internal Network Entry
- Internal host access after pivoting4. Privilege Escalation
- Before and after: standard user → admin/root5. Domain Controller Compromise
- whoami or hostname output on the DC
- Domain Admins group membership confirmation
- secretsdump or ntds.dit dump success6. Sensitive Data Access
- Access to critical files or credential files
What makes a good screenshot:
- Command and output visible in a single frame
- IP address and hostname visible to identify the system
- Timestamp included (terminal prompt or system clock)
- Resolution high enough to read all textCommon mistakes:
- Screenshots too small to read
- No way to identify which system is shown
- Missing before-state screenshots (no comparison possible)
- Taking all screenshots at the end (impossible to recreate after exam ends)※ Passing candidate Fajao stated: “I failed my first attempt due to insufficient screenshots and missing information. Take an excessive number at every single step.”
[Step 9: Attack Chain]
The goal in this phase is to narrate the entire attack flow from OSINT through Domain Controller compromise as a single cohesive story.
This is the most heavily evaluated section on the PNPT exam.
Writing Structure:
[Phase 1 — OSINT]"OSINT was performed against the target domain (target.com),
yielding the following information."Collected:
- Email address list
- Leaked credentials
- Subdomain list
- Employee LinkedIn profiles[Screenshot — email harvesting results]
[Screenshot — leaked credentials discovered]--------------------------------------------------------------------[Phase 2 — External Penetration]"Using collected emails and leaked passwords, a password spray
was performed against the O365 portal."- Services discovered: OWA (10.10.10.1), VPN portal (10.10.10.2)
- Spray result: user@target.com / Password2023! — authentication successful[Screenshot — password spray success]
[Screenshot — obtained credentials]--------------------------------------------------------------------[Phase 3 — Initial Foothold]"Using the obtained credentials, VPN access was established and
internal network entry was achieved."[Screenshot — VPN connection success]
[Screenshot — internal network host scan results]--------------------------------------------------------------------[Phase 4 — Internal Enumeration & AD Attacks]"On the internal network, NTLMv2 hashes were captured via LLMNR
Poisoning, and service account passwords were obtained through
Kerberoasting."- LLMNR Poisoning → jdoe NTLMv2 hash captured → cracked → Password1234
- Kerberoasting → svc_sql ticket captured → cracked → SQLService123[Screenshot — Responder hash capture]
[Screenshot — cracking success]--------------------------------------------------------------------[Phase 5 — Privilege Escalation & Domain Controller Compromise]"Using the obtained service account credentials, the DC was
accessed and a DCSync attack was performed to dump all domain hashes."[Screenshot — DC access confirmed]
[Screenshot — DCSync / secretsdump output]
[Screenshot — whoami /all or hostname on DC]
[Screenshot — Domain Admins group confirmed]
[Step 10: Remediation Recommendations]
The goal in this phase is to provide specific, actionable fixes for each discovered vulnerability.
Common vulnerability remediation guidance:
[LLMNR / NBT-NS Poisoning]
- Disable LLMNR via GPO
- Disable NBT-NS
- Enforce strong password policy (minimum 12 characters, complexity required)--------------------------------------------------------------------[Password Spraying / Brute-Force]
- Implement account lockout policy (lock for 30 minutes after 5 failed attempts)
- Enforce MFA (mandatory for all externally accessible services)
- Apply a password filter that checks against known breach databases--------------------------------------------------------------------[Kerberoasting]
- Rotate service account passwords to random strings of 25+ characters
- Implement Group Managed Service Accounts (gMSA)
- Enforce AES encryption (disable RC4)--------------------------------------------------------------------[Pass-the-Hash]
- Deploy LAPS (Local Administrator Password Solution)
- Enable SMB Signing
- Utilize the Protected Users security group--------------------------------------------------------------------[AS-REP Roasting]
- Enable Kerberos Pre-Authentication
(Uncheck "Do not require Kerberos preauthentication" in account properties)--------------------------------------------------------------------[DCSync]
- Remove DCSync rights (Replicating Directory Changes) from all accounts
outside Domain Admins and Enterprise Admins
- Monitor for changes to this permission (Event ID 4662)--------------------------------------------------------------------[Vulnerable Software Versions]
- Establish a regular patch and update management process--------------------------------------------------------------------[Insufficient Internal Network Segmentation]
- Implement VLAN segmentation to separate user, server, and management networks
- Apply the Principle of Least Privilege throughout
[Step 11: Appendix]
The goal in this phase is to organize reference material that is too detailed for the main body but useful as supplementary information.
Writing Example:
[Tools Used]Tool Purpose
-----------------------------------------
Nmap Port scanning and service enumeration
Responder LLMNR/NBT-NS poisoning
Hashcat Offline password cracking
CrackMapExec SMB enumeration and credential validation
BloodHound AD privilege relationship visualization
Impacket DCSync, Kerberoasting
Ligolo-ng Pivoting tunnel--------------------------------------------------------------------[References]- NIST SP 800-115: Technical Guide to Information Security Testing
- MITRE ATT&CK Framework: https://attack.mitre.org
- TCM Security Sample Report: https://github.com/hmaverickadams/TCM-Security-Sample-Pentest-Report
[Step 12: Debrief Preparation]
The goal in this phase is to present your attack flow to a TCM Security examiner in 15 minutes, based on the submitted report.
Preparation:
[Presentation Format]
- Screen share your report directly (most passing candidates use this)
- Separate PowerPoint is optional — not required--------------------------------------------------------------------[Presentation Order (15 minutes)]
- Brief self-introduction (1 min)
- Executive Summary recap (2 min)
- Top 3–5 key findings summary (5 min)
- Full Attack Chain walkthrough (5 min)
- Key remediation highlights (2 min)--------------------------------------------------------------------[Common Examiner Questions]
- "How did you discover this vulnerability?"
- "Why did you classify this as Critical?"
- "What would a real attacker do next?"
- "Which remediation should be prioritized first?"
Important notes:
- Findings without screenshots are difficult to explain
(This is where the importance of in-exam screenshots becomes clear again)
- Examiners already know all the techniques — focus on
"why this is a problem" rather than explaining how it works
- If you don't know the answer to a question, say so honestly[Core Report Writing Principles]
[Absolute Rules]1. Take screenshots immediately at every stage during the exam
Backfilling later is impossible. Capture now.2. Write vulnerabilities so they are reproducible
An examiner should be able to follow your steps exactly.3. Executive Summary must use non-technical language
"Captured NTLMv2 hashes via Responder"
→ "Intercepted network communications to obtain user credentials"4. Every vulnerability must include a remediation recommendation
Avoid vague statements like "apply patch"
Specify exact GPO settings, service disablement steps, etc.5. The TCM Security sample template is strongly recommended
https://github.com/hmaverickadams/TCM-Security-Sample-Pentest-Report--------------------------------------------------------------------[Recommended Tools]Report writing : Microsoft Word / LibreOffice Writer (.docx)
Note-taking : CherryTree / Obsidian / KeepNote
Screenshots : Flameshot (Linux) / Greenshot (Windows)--------------------------------------------------------------------[In-Exam Note Template]## [Hostname / IP]
- Time discovered:
- Services:
- Vulnerability:
- Commands used:
- Result:
- Screenshot filename:
- Remediation:
※ Even a technically perfect compromise results in failure if the report quality is poor. Dedicate both full report days entirely to writing.
→ A sample report built with Claude is available here.
