OSCP-Exam-Report-Template-Markdown VS public-pentesting-reports

Thank you! Yes, I used https://github.com/noraj/OSCP-Exam-Report-Template-Markdown and included vulnerability details, as well as how to fix the vulnerability and it got lengthy which I think was unnecessary, but I tried to make it nice and be thorough. I probably should've put more time in trying to fix the other issues I had but oh well.

I am in the process of redacting my report. In fact, I have already documented all 10 machines and all exercises in the lab. However, i have still a question regarding the expected content of it, as the official template as well as some famous templates such as this one mention a whole introduction section containing among all introduction, objectives, requirements, methodologies...

Here a good starting point: https://github.com/noraj/OSCP-Exam-Report-Template-Markdown

Also you can take a look at the OSWE Exam Report Template in Markdown I you prefer to avoid Word.

I wrote my reports in Markdown using the format here. I researched more about pandoc and decided to convert my Markdown documents to docx first, edit them in LibreOffice (Page Breaks, better Table of Contents), and export them to PDF for submission Test your report conversion before the exam. This helped me figure out issues with my report conversion before the exam (issues with special characters in my terminal), and switch to a system that works. Another good report format can be found here, this one provides resources

However things I did do right was to right the whole thing in markdown in obsidian. I used flameshot to get all my screenshots and converted the markdown to a pdf with eisvogel using this GitHub as a template https://github.com/noraj/OSCP-Exam-Report-Template-Markdown

You might find https://github.com/juliocesarfort/public-pentesting-reports repository useful if you need to see how reports are generally structured and written.

As for templates, to be honest, I haven't come across many templates floating around. You could look through public pentest reports (https://github.com/juliocesarfort/public-pentesting-reports) and borrow the bits that you prefer and drop them into TCM's template and make it your own.

I know of this site https://redteam.guide/docs/Templates/report_template/ which for me is down but maybe that is temporary, otherwise seek the cached or wayback version. There are also these https://github.com/juliocesarfort/public-pentesting-reports which are pentesting reports but you may find a number that are more about red teaming or have elements of red teaming which you can refer to.

A repository of pentest reports. Writing reports is the most important component of pentesting and redteaming. A pentester who cannot explain what they did, what they found and what the recipient should do to fix their issues is of limited value.

If you're anything like me, examples help tremendously and so: https://github.com/juliocesarfort/public-pentesting-reports

For good examples, look here. I'd do a test with most of the firms on that list.

I'd say don't let yourself be discouraged by GP. Just look into a company before you apply. Many have public reports you could look at or security research they publish, both of which you could use as indicators.

Here's a repo with lots of public audit reports by various companies, you could use that as a starting point: https://github.com/juliocesarfort/public-pentesting-reports