Interactive Report Builder
Build professional penetration testing reports directly in your browser. Add findings, configure report details, preview your work, and export to Markdown or JSON.
How to Use
- Configuration: Set client name, assessment type, dates, and scope
- Findings: Add vulnerabilities with severity, CVSS scores, and details
- Preview: Review your formatted report before export
- Export: Download as Markdown (.md) or JSON for further editing
Browser Storage
This tool runs entirely in your browser. Your data is NOT saved between sessions.
Use the JSON export feature to save your work and import it later.
📄Interactive Report Builder
Build professional penetration test reports with findings management and export options
Report Completion
29%
Tips for Better Reports
Finding Descriptions
- Be specific about what was found and where
- Include the attack vector or method used
- Explain the potential business impact
- Reference CVEs or CWEs when applicable
Remediation Guidance
- Provide actionable steps, not just "fix it"
- Include code examples when helpful
- Link to official documentation
- Suggest both quick fixes and long-term solutions
CVSS Scoring
- Use CVSS 3.1 for consistency
- Consider environmental factors
- Document your scoring rationale
- Be prepared to justify scores to clients
Evidence & PoC
- Add evidence after exporting to Markdown
- Include annotated screenshots
- Show request/response pairs
- Redact sensitive data appropriately
Recommended Workflow
Configure
Set report metadata
Add Findings
Enter all vulnerabilities
Export JSON
Save work in progress
Export MD
Generate final report
Add Evidence
Insert screenshots
Likely False Positives
The builder produces a skeleton faithfully, including any weakness in what was entered. These are the exports that overstate or understate the finding set.
- Entry order read as severity order: The findings list is ordered as typed. A reader assumes the top of the table is the top risk, whatever the scores say.
- Score entered, vector implied: A CVSS score typed without its vector cannot be checked, and the next reviewer will recompute it differently.
- Blank field read as cleared: An empty remediation field in the export looks like no fix is available rather than not yet written.
- Duplicate entries: The tool will happily store two records for one weakness, and the summary counts then overstate the finding set.
- Structure mistaken for a report: The export is a skeleton: scope, methodology, limitations and engagement metadata are not generated for you.
- Stored nowhere: The builder keeps nothing between sessions, so an unexported draft is a report that does not exist.
Post-Export Checklist
After export
- ☐ Every finding entered has survived into the Markdown export
- ☐ Summary counts match the findings actually entered
- ☐ CVSS scores recomputed after any severity was edited
- ☐ Client name and assessment dates correct in the header block
- ☐ JSON export saved before the browser session is closed
Before sending
- ☐ Evidence inserted after export and cross-referenced to each finding
- ☐ Redaction pass run on the exported document rather than inside the tool
- ☐ Scope, methodology and limitations written, since the tool does not generate them
- ☐ Executive summary written from the findings instead of left as template text
- ☐ Version number and date added before the file leaves the machine