Reporting Documentation

Notes and raw tool output are the foundation of the report. This page is the evidence discipline that runs the whole engagement: the folder structure, continuous terminal logging, the investigation notes, and the activity/payload/system-modification trackers that later become report appendices. Capture as you go and writing the report becomes assembly, not archaeology — see Report_Writing for the assembly, Reporting_Findings_Types for the per-finding template.

🛡️ Methodology Checklist

Create the engagement folder structure + the 12 investigation notes before testing
Open the engagement folder as an Obsidian vault
Start a tmux session with logging enabled; raise history-limit
Save all scan output with -oA into Evidence/Scans/
Keep the Activity Log and Payload Log current as you work
One folder per finding under Evidence/Findings/
Capture screenshots: YYYY-MM-DD_HHMM_[HOST]_[FINDING]_desc.png
Redact secrets safely (<PASSWORD REDACTED>, <SNIP>) — never blur/pixelate
Track system modifications; get written approval before risky/hard-to-reverse changes

🎯 Operational Context

Use when: Throughout the assessment — capturing evidence and notes so the report assembles from artifacts instead of memory. Think Dumber First: Log the terminal continuously (scrollback is not evidence). Capture the moment something works — re-creating it later costs far more than capturing it now. Every exploited issue needs: the exact command, its output, a screenshot of impact, and the affected asset. Skip when: N/A — evidence discipline runs the entire engagement.

⚡ Tactical Cheatsheet

Command	Outcome
`ENG="[CLIENT]-[TYPE]"; mkdir -p "$ENG"/{Admin,Deliverables,Evidence/{Findings,Scans/{Vuln,Service,Web,'AD Enumeration'},Notes,OSINT,Wireless,'Logging output','Misc Files'},Retest}`	Create engagement folder structure — folders only (set `ENG` first)
`cd "$ENG/Evidence/Notes" && touch "1. Administrative Information.md" "2. Scoping Information.md" "3. Activity Log.md" "4. Payload Log.md" "5. OSINT Data.md" "6. Credentials.md" "7. Web Application Research.md" "8. Vulnerability Scan Research.md" "9. Service Enumeration Research.md" "10. AD Enumeration Research.md" "11. Attack Path.md" "12. Findings.md" "System Modifications.md"`	Create the 12 investigation notes (run after the folder scaffold; reuses `$ENG`)
`tmux new -s [SESSION]`	Start a named tmux session
`Ctrl-b Shift-p`	Start / stop tmux pane logging
`sudo nmap -Pn -sV -sC -oA Evidence/Scans/Service/[BASE] [TARGET_IP]`	Service scan, all output formats (`-oA`)
`sudo nmap -Pn -p- --min-rate 5000 -oA Evidence/Scans/Service/[BASE]-full [TARGET_IP]`	Full TCP port scan, output preserved
`sha256sum [PAYLOAD]`	Hash a payload for the Payload Log
`script -q Evidence/'Logging output'/[HOST].log`	Log a shell session to file
`whoami /all > whoami-all.txt; hostname > hostname.txt; ipconfig /all > ipconfig-all.txt`	Save Windows proof artifacts
`tar -czvf [CLIENT]_[TYPE]_archive.tar.gz [ENG]/`	Archive the engagement
`curl ifconfig.me` · `ip addr show tun0`	Confirm public IP · get VPN IP for source-IP records

Run from the engagement root. The Evidence/… paths above are relative to $ENG/, so cd "$ENG" before scanning or logging. The notes step (cd "$ENG/Evidence/Notes") leaves you deep in the tree — cd ~/…/$ENG back to the root first, or -oA Evidence/Scans/… resolves to a doubled, non-existent path and nmap fails with “No such file or directory” (-oA won’t create missing parents).

🔬 Deep Dive & Workflow

Engagement Folder Structure

One clean folder per engagement, opened as an Obsidian vault. Evidence is organised by type, with one folder per finding and all raw scan output preserved.

[ENGAGEMENT]/                 # e.g. ACME-IPT or [CLIENT]-[TYPE]
├── Admin/                    # POCs, PMs, objectives, deadlines, contract, scope docs
├── Deliverables/             # draft + final report, attestation, slide deck
├── Evidence/
│   ├── Findings/             # one folder per finding (see below)
│   ├── Scans/
│   │   ├── Vuln/             # Nessus/OpenVAS output
│   │   ├── Service/          # nmap -oA, service enumeration
│   │   ├── Web/              # ffuf/gobuster/nikto/web fuzzing
│   │   └── AD Enumeration/   # BloodHound, PowerView, ADRecon
│   ├── Notes/                # the 12 investigation notes (below)
│   ├── OSINT/                # external recon data
│   ├── Wireless/             # wireless captures (if in scope)
│   ├── Logging output/       # tmux / script terminal logs
│   └── Misc Files/           # anything that doesn't fit
└── Retest/                   # post-remediation evidence

Scaffold it in one shot:

ENG="[CLIENT]-[TYPE]"   # e.g. ACME-IPT
mkdir -p "$ENG"/{Admin,Deliverables,Evidence/{Findings,Scans/{Vuln,Service,Web,'AD Enumeration'},Notes,OSINT,Wireless,'Logging output','Misc Files'},Retest}
tree "$ENG"

The 12 Investigation Notes

Create these Markdown notes inside Evidence/Notes/ — they map onto the report’s sections and appendices, so keeping them current means the report writes itself.

cd "$ENG/Evidence/Notes"
touch "1. Administrative Information.md" "2. Scoping Information.md" "3. Activity Log.md" \
      "4. Payload Log.md" "5. OSINT Data.md" "6. Credentials.md" \
      "7. Web Application Research.md" "8. Vulnerability Scan Research.md" \
      "9. Service Enumeration Research.md" "10. AD Enumeration Research.md" \
      "11. Attack Path.md" "12. Findings.md" "System Modifications.md"

Note	Purpose
1. Administrative Information	POCs, PMs, objectives, deadlines, todo list
2. Scoping Information	In-scope IPs/domains/URLs, supplied creds, exclusions
3. Activity Log	High-level timeline of testing activity (template below)
4. Payload Log	Payloads/tools uploaded — hashes, paths, cleanup status
5. OSINT Data	External recon findings
6. Credentials	Central list of discovered credentials/secrets
7. Web Application Research	Interesting apps, screenshots, default creds tried
8. Vulnerability Scan Research	Vuln-scan results and follow-up
9. Service Enumeration Research	Nmap/service testing and failed attempts
10. AD Enumeration Research	BloodHound, PowerView, Kerberoasting, etc.
11. Attack Path	End-to-end compromise chain (template below)
12. Findings	Draft finding list + report mapping (template below)

Crosswalk from earlier scaffolds: if you used the older numbered layout, the artifacts map straight across — engagement-details.md → 1. Administrative Information, the scope .md files → 2. Scoping Information, credentials.md → 6. Credentials, findings-tracker.md → 12. Findings.

Terminal Logging with tmux

Screenshots alone are messy and incomplete — log the terminal continuously. Install TPM and the logging plugin once:

git clone https://github.com/tmux-plugins/tpm ~/.tmux/plugins/tpm

Add to ~/.tmux.conf (raise history so retroactive saves work):

set -g mouse on
set -g history-limit 50000
set -g @plugin 'tmux-plugins/tpm'
set -g @plugin 'tmux-plugins/tmux-sensible'
set -g @plugin 'tmux-plugins/tmux-logging'
run '~/.tmux/plugins/tpm/tpm'

Reload (tmux source ~/.tmux.conf), then Ctrl-b Shift-i inside tmux to install plugins.

Action	Shortcut
Start / stop pane logging	`Ctrl-b Shift-p`
Save full pane history (forgot to log)	`Ctrl-b Alt-Shift-p`
Capture current pane only	`Ctrl-b Alt-p`
Vertical / horizontal split	`Ctrl-b Shift-%` · `Ctrl-b Shift-"`

Logs land under ~ / the configured path — collect them into Evidence/Logging output/. The log file may only fully populate after logging stops or the session exits.

Activity Log — `Evidence/Notes/3. Activity Log.md`

A high-level timeline. Proves what was tested, helps correlate client alerts, and protects you if activity is questioned.

| Timestamp | Source IP | Target | Action | Tool/Command | Result |
|-----------|-----------|--------|--------|--------------|--------|
| [YYYY-MM-DD HH:MM] | [ATTACKER_IP] | [TARGET_IP] | Initial TCP scan | nmap | Open ports found |
| [YYYY-MM-DD HH:MM] | [ATTACKER_IP] | [TARGET_IP] | SMB auth test | netexec | Valid credentials |

Payload Log — `Evidence/Notes/4. Payload Log.md`

Feeds the report’s Exploitation Attempts & Payloads appendix. Hash every payload (sha256sum).

| Timestamp | Target | Payload/Tool | Local Path | Remote Path | SHA256 | Cleanup Status |
|-----------|--------|--------------|------------|-------------|--------|----------------|
| [TIME] | [HOST] | [TOOL] | [LOCAL_PATH] | [REMOTE_PATH] | [HASH] | Removed / Left for client |

System Modifications — `Evidence/Notes/System Modifications.md`

Feeds the Configuration Changes appendix. Track accounts created, services/configs/registry changed, web shells, SSH keys. Get written approval before risky or hard-to-reverse changes.

| Timestamp | Host | Change | Location | Account/Service | Approval | Reverted |
|-----------|------|--------|----------|-----------------|----------|----------|
| [TIME] | [HOST] | [DESCRIPTION] | [PATH/CONFIG] | [ACCOUNT/SERVICE] | [APPROVAL_REF] | Yes/No |

Credentials — `Evidence/Notes/6. Credentials.md`

Every credential, hash, or ticket the moment you find it, with where it came from and where it works — this table is your lateral-movement map and feeds the Compromised Credentials appendix. (The live Engagement_Cockpit Credential Ledger is the same data while you operate.)

| Credential | Type | Source Host | Works On | Privilege | Notes |
|-----------|------|-------------|----------|-----------|-------|
| [USER]:[PASSWORD] | cleartext | WEB01 (config.php) | DC01, FILE01 | domain user | reused everywhere |
| [USER] / [NTLM_HASH] | NTLM hash | DC01 (mimikatz) | DC01 | local admin | PtH only |
| [USER] (.ccache) | Kerberos TGT | DC01 (secretsdump) | domain-wide | domain admin | expires ~10h |

Type: cleartext / NTLM hash / Kerberos ticket / AES key / NTDS dump.
Works On: fill in as you confirm reuse — blank means untested, not “doesn’t work.”

Attack Path — `Evidence/Notes/11. Attack Path.md`

The end-to-end compromise chain, captured as you go so Report_Writing’s attack-chain section is a copy job. Pair it with a host-context table (the live version is the Engagement_Cockpit Host Tracker).

## Chain
1. External discovery identified [HOST/SERVICE].
2. Authentication succeeded using [CREDENTIAL_SOURCE].
3. Exploitation of [VULN] led to [ACCESS_LEVEL].
4. Privilege escalation via [METHOD]; lateral movement to [HOST] via [TECHNIQUE].
 
## Host Context
| Host | IP | Role | Foothold (how you got in) | Reaches / Pivots To |
|------|----|------|---------------------------|---------------------|
| WEB01 | 10.10.110.21 | DMZ web server | LFI → RCE → www-data | 172.16.5.0/24 (internal) |
| DC01 | 10.10.110.20 | Domain Controller | PtH local admin from WEB01 creds | domain-wide |

Findings — `Evidence/Notes/12. Findings.md`

Master index of findings, one row per finding, each pointing at its folder under Evidence/Findings/.

| ID | Finding | Severity | Affected Host(s) | Status | Evidence folder |
|----|---------|----------|------------------|--------|-----------------|
| F-001 | [FINDING_TITLE] | Critical | DC01 | confirmed | Findings/F-001 - [slug]/ |
| F-002 | [FINDING_TITLE] | High | WEB01 | draft | Findings/F-002 - [slug]/ |

One folder per finding holds its screenshots, raw output, tool logs, and draft narrative:
```
mkdir -p "$ENG/Evidence/Findings/F-001 - Kerberoasting"
```
Status: identified → evidence-captured → written → reviewed.

Evidence Handling & Redaction

Prefer terminal output over screenshots — easier to redact, copy, reproduce, and smaller in reports.
Redact safely: <PASSWORD REDACTED>, <HASH REDACTED>, <SNIP>, or partial hash 5835<SNIP>10ef. Never blur, pixelate, or use Word overlay shapes — they’re reversible. Never invent or alter output.
Prove target ownership in GUI/browser evidence: URL in the address bar, hostname, or ipconfig/ifconfig.
Don’t archive unnecessary sensitive data — screenshot a directory listing instead of exfiltrating PII.

Evidence Type	Required	Screenshot Alone Sufficient?
Command output	Yes	No — need raw output too
Target ownership proof	Yes	Yes (if URL/hostname visible)
Privilege proof (`whoami`)	Yes	Yes + hostname context
Credential capture	Yes	No — need packet capture or raw file
Exploitation impact	Yes	Preferred with terminal output

Screenshot naming: YYYY-MM-DD_HHMM_[HOST]_[FINDING]_description.png. Capture at: initial access · successful auth · exploit execution · privilege escalation (whoami /priv, id) · sensitive file access · domain compromise · flag/proof · configuration proof.

Key Reporting Principles

Snapshot disclaimer: “This report represents a snapshot in time during the testing period.”
Source IPs: document all VPN/public/internal IPs used (kept in 1. Administrative Information).
Scope from file: nmap -Pn -iL "Evidence/Notes/2. Scoping Information.md" style — never scan from memory. Keep the target list as bare hosts, one per line.
Exclusions: always ask the client for explicit out-of-scope systems (fragile/OT/regulated).
Incident preservation: if the client claims an outage, immediately archive timestamps, scope docs, scan output, and source IPs.

🛠️ Troubleshooting & Edge Cases

Problem	Cause	Fix
Forgot tmux logging	Logging not started	`Ctrl-b Alt-Shift-p` saves pane history (needs high `history-limit`)
tmux log file empty	Buffer not flushed	Stop logging or exit the session; then collect the `.log`
Copied output from two panes	Split-pane copy	`Ctrl-b Alt-p` captures the current pane only
Screenshot evidence lost	Terminal closed before capture	Keep `script` / tmux logging running throughout
Password visible in screenshot	No redaction	Burn in solid redaction before adding to the report
Cannot reproduce a finding	Timing-dependent exploit	Document the conditions and intermittency; include error states
Archived sensitive files unnecessarily	Over-collection	Screenshot the directory listing instead of copying contents

📝 Reporting Trigger

Finding Title: N/A — evidence/notetaking discipline, not a vulnerability finding. Impact: Disciplined evidence capture preserves command output, timelines, payload usage, and finding-specific proof — the difference between a defensible report and one that can be challenged. Root Cause: N/A — operational reference. Recommendation: Create the folder structure and 12 notes on day 1, log every terminal session, save raw scan output with -oA, keep the Activity/Payload/System-Modification logs current, store one folder of evidence per finding, and redact secrets with safe placeholders rather than blur.

Report_Writing — assembling the report from this evidence (exec summary, attack chain, appendices)
Reporting_Findings_Types — report types, deliverable decision tree, and the per-finding template
Finding_Library — reusable finding write-ups seeded from the manual’s 📝 Reporting Trigger blocks
Reporting_SysReptor — the SysReptor production workflow and report-readiness checkpoints
Engagement_Cockpit — the live Host Tracker and Credential Ledger
Linux_PrivEsc_Enumeration · Windows_PrivEsc_Enumeration

Field Manual

Explorer

Reporting Documentation

🛡️ Methodology Checklist

🎯 Operational Context

⚡ Tactical Cheatsheet

🔬 Deep Dive & Workflow

Engagement Folder Structure

The 12 Investigation Notes

Terminal Logging with tmux

Activity Log — `Evidence/Notes/3. Activity Log.md`

Payload Log — `Evidence/Notes/4. Payload Log.md`

System Modifications — `Evidence/Notes/System Modifications.md`

Credentials — `Evidence/Notes/6. Credentials.md`

Attack Path — `Evidence/Notes/11. Attack Path.md`

Findings — `Evidence/Notes/12. Findings.md`

Evidence Handling & Redaction

Key Reporting Principles

🛠️ Troubleshooting & Edge Cases

📝 Reporting Trigger

Graph View

Table of Contents

Backlinks

Field Manual

Explorer

Reporting Documentation

🛡️ Methodology Checklist

🎯 Operational Context

⚡ Tactical Cheatsheet

🔬 Deep Dive & Workflow

Engagement Folder Structure

The 12 Investigation Notes

Terminal Logging with tmux

Activity Log — Evidence/Notes/3. Activity Log.md

Payload Log — Evidence/Notes/4. Payload Log.md

System Modifications — Evidence/Notes/System Modifications.md

Credentials — Evidence/Notes/6. Credentials.md

Attack Path — Evidence/Notes/11. Attack Path.md

Findings — Evidence/Notes/12. Findings.md

Evidence Handling & Redaction

Key Reporting Principles

🛠️ Troubleshooting & Edge Cases

📝 Reporting Trigger

🔗 Related Nodes

Graph View

Table of Contents

Backlinks

Activity Log — `Evidence/Notes/3. Activity Log.md`

Payload Log — `Evidence/Notes/4. Payload Log.md`

System Modifications — `Evidence/Notes/System Modifications.md`

Credentials — `Evidence/Notes/6. Credentials.md`

Attack Path — `Evidence/Notes/11. Attack Path.md`

Findings — `Evidence/Notes/12. Findings.md`