---
title: "Penetration Test Report: What You Get | Mr Cyber"
url: https://mr-cyber.com/sample-report
language: en
description: "See what to expect from a Mr Cyber pentest report: executive summary, findings with CVSS 3.1, reproduction steps, remediation and retest."
---
# Report
A good report answers two questions: how big is the risk, and what exactly do we do about it? This is how a Mr Cyber report is structured.
## What’s in the report
1. ### Executive summary
The risk picture on one page, for management and auditors.
2. ### Scope & methodology
Targets, timeframe, test type and standards, clearly documented.
3. ### Findings overview
All findings prioritised by risk, with status.
4. ### Detailed findings
Description, reproduction, evidence, impact, remediation, CVSS 3.1.
5. ### Remediation plan
What to fix first, with effort estimates.
6. ### Retest confirmation
Proof of fixed findings for your auditor.
7. ### Ticket import file
Every finding as CSV, JSON and email for Jira, ServiceNow, GitLab, Azure DevOps and GitHub. Helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 receive them by email import.
8. ### Attestation letter
One page for auditors, customers and insurers, without the confidential report.
## A single finding
Pentest report · Admin & Söhne GmbH · MC-2026-014
Risk: High CVSS 3.1 · 8.2 Open · retest included
### Admin area reachable without login
app.admin-soehne.example · /admin
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
#### Description
The administration area at /admin opens without asking for a password. Anyone who types the address sees the full customer list with names, addresses and order history, and can change a few settings such as the shop’s opening notice.
#### Steps to reproduce
1. Open a private browser window, without logging in.
2. Go to https://app.admin-soehne.example/admin.
3. The admin dashboard loads, showing all customers and edit buttons.
```
GET /admin HTTP/2
Host: app.admin-soehne.example
HTTP/2 200
Admin Dashboard …
```
#### Business impact
Anyone on the internet can read all customer data, with no account and no special skill. That is a GDPR data breach that must be reported within 72 hours, plus a letter to every customer. Search engines or automated scanners can find this kind of page within days.
#### Remediation
Protect the whole /admin area with a mandatory login on the server, and require two-factor authentication for admins. Better still, make the admin area reachable only from the company network or VPN. Add an automated test that checks every admin page refuses access without login.
OWASP Top 10 2021: A01 Broken Access Control · CWE-306 (Missing Authentication for Critical Function)
Admin & Söhne GmbH and admin-soehne.example are invented.
## Fixed, then verified. On retest, not on trust.
After you fix, we test the same finding again, the same way. The report then shows each finding as fixed and verified, with the date and how we checked.
Retest confirmation · Admin & Söhne GmbH · MC-2026-014
Fixed · verified on retestWas: Risk High · CVSS 8.2
### Admin area reachable without login
```
GET /admin HTTP/2
Host: app.admin-soehne.example
HTTP/2 302
Location: /login
```
Retest
After the fix, with the same method as the test
How verified
/admin now redirects to the login. Tested without a session, with an ordinary customer account and with an expired session.
Result
Access refused in all three cases. Finding closed.
## Attestation letter. Proof without the report.
One page you can pass to auditors, customers and insurers: who tested what and when, the scope, the standards, and that the findings were fixed and verified on retest. The confidential report stays with you; the letter confirms our test and is not a certification.
Mr Cyber
### Attestation letter
Client
Admin & Söhne GmbH
Tested by
Mr Cyber
Test type
Manual web application penetration test
Scope
app.admin-soehne.example, including /admin
Sequence
Test · retest after the fix
Standards
OWASP WSTG · OWASP Top 10 2021 · CVSS 3.1
Result
11 findings (1 Critical, 2 High, 5 Medium, 3 Low), all fixed and verified on retest. No open findings in scope.
Confirms the test described above. Not a certification.
## Findings become tickets. Imported, not retyped.
Every report comes with an import file for Jira, ServiceNow, GitLab, Azure DevOps and GitHub. Helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 receive the tickets by email import. One finding becomes one ticket, with title, severity and priority, affected asset, description, steps to reproduce, recommended fix and references. 30 findings = 30 tickets nobody has to type.
Client portal with triage, status per finding and one-click ticket creationIn development
ProjectsIT Security Operations IT-SECOPS-142
\[MC-2026-014\] Admin area reachable without login
To Do
Details
Assignee
Unassigned
Reporter
Mr Cyber
Priority
High
Labels
- pentest
- security
- severity-high
- web
Sprint
None
Issue type
Bug
Description
**Finding:** MC-2026-014
**Severity:** High
CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
Affected asset
- app.admin-soehne.example · /admin
Description
The administration area at /admin opens without asking for a password. Anyone who types the address sees the full customer list with names, addresses and order history, and can change a few settings such as the shop’s opening notice.
Steps to reproduce
1. Open a private browser window, without logging in.
2. Go to https://app.admin-soehne.example/admin.
3. The admin dashboard loads, showing all customers and edit buttons.
GET /admin HTTP/2
Host: app.admin-soehne.example
HTTP/2 200
Admin Dashboard …
Impact
Anyone on the internet can read all customer data, with no account and no special skill. That is a GDPR data breach that must be reported within 72 hours, plus a letter to every customer. Search engines or automated scanners can find this kind of page within days.
Recommended fix
Protect the whole /admin area with a mandatory login on the server, and require two-factor authentication for admins. Better still, make the admin area reachable only from the company network or VPN. Add an automated test that checks every admin page refuses access without login.
References
- OWASP Top 10 2021: A01 Broken Access Control
- CWE-306 (Missing Authentication for Critical Function)
How the finding looks after import into Jira (recreated view).