Lion Cipher Lab
Lint a pentest report for scope, severity and data leaks before it ships
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A penetration test report is the product a client pays for. The errors that damage a tester's reputation are usually not technical misjudgements. They are the avoidable ones: a finding labelled High whose own CVSS score is Critical, an affected host that was never in the signed scope, a live password or a real customer's card number pasted into the evidence, a finding with an empty description, a remediation that just says 'Patch'. Each one makes the client doubt the rest of the report, and a leaked secret or out-of-scope asset can turn into a contractual or legal problem. NIST SP 800-115…
What you'll learn
- the report errors that damage a tester's credibility
- checking severity labels against the CVSS v4.0 rating scale
- checking affected assets against the signed scope
- detecting secrets and personal data in evidence text
- the Luhn check for card numbers
- flagging vague remediation
- knowing what automated report QA cannot catch
Steps in this lab
- The errors worth automating
- The sample report and scope
- Write the linter
- Run it and fix the report
- Measure what it misses