Skip to content
Michal Rajecký
ENCS
Menu

00.4

Sample report

The report is the deliverable. This is a real one from a real engagement, redacted, so you can judge the work before you commission any.

PDF

60 pages · 12 findings · CVSS 3.1

Download the PDF

Your browser cannot display the PDF inline. Download it instead.

WHAT YOU RECEIVE

  • An executive summary written for the person who signs off, not for an engineer.
  • A severity ranked table of every finding with its page number.
  • Remediation grouped into short, medium and long term.
  • Each finding with CWE, CVSS 3.1 vector, root cause, impact, affected components, remediation steps and references.
  • Evidence for each finding: the requests, the responses, and what they prove.
  • An appendix inventorying every account, document and file created during testing, with cleanup status.

HOW SEVERITY IS SET

Every finding carries a CVSS 3.1 base score and its full vector string, so you can check the arithmetic. The score sets the band: critical 9.0 to 10.0, high 7.0 to 8.9, medium 4.0 to 6.9, low 0.1 to 3.9, informational 0.0.

ON THE REDACTION

The client, their domain, their people and their infrastructure identifiers are replaced throughout. Screenshots are removed rather than covered. Credentials and tokens are stripped at the glyph level, not hidden behind boxes, and the file carries no metadata, attachments or retained revisions.

ONE FINDING, IN FULL

7. Missing DMARC Enforcement and SPF Softfail Permit Email Spoofing

4.3

CWE
CWE-290 · Authentication Bypass by Spoofing
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Root cause
The web.app domain publishes DNS records that, in combination, allow any external party to send email with a From: address claiming to be from web.app and have those messages delivered to recipient mailboxes without being rejected. The SPF record at the apex ends in ~all, the softfail mechanism, which instructs receiving mail servers to treat unauthenticated senders as suspicious but to accept and deliver them anyway. The DMARC policy published at _dmarc.web.app is v=DMARC1; p=none; with no rua= aggregate-reporting endpoint and no ruf= failure-reporting endpoint.
Affected
  • DNS TXT record on "web.app" (SPF)
  • DNS TXT record on "_dmarc.web.app"
Remediation
  1. 1.Publish DMARC aggregate reports. Replace the _dmarc.web.app TXT record with: v=DMARC1; p=none; rua=mailto:dmarc-reports@web.app
  2. 2.Change the trailing ~all in the web.app SPF record to -all
  3. 3.Escalate the DMARC policy: p=quarantine; pct=25 then p=reject; pct=100
References