Skip to content

report-guide.md

Latest commit

 

History

History
438 lines (340 loc) · 9.72 KB

report-guide.md

File metadata and controls

438 lines (340 loc) · 9.72 KB
Raw

📊 Security Testing Report Guide

Overview

Fray now includes a professional HTML report generator with Dali Security branding that automatically analyzes your test results and provides actionable security recommendations.

🎯 Features

Comprehensive Analysis

  • ✅ Vulnerability identification by category
  • ✅ Payload statistics (blocked vs bypassed)
  • ✅ Security score calculation
  • ✅ Severity-based prioritization
  • ✅ Detailed recommendations with fix guidance

Professional Branding

  • ✅ Dali Security logo and styling
  • ✅ Modern, responsive design
  • ✅ Print-ready format
  • ✅ Executive summary section
  • ✅ Color-coded severity levels

Actionable Insights

  • ✅ Specific fix recommendations for each vulnerability
  • ✅ Priority-based action items
  • ✅ Category-by-category breakdown
  • ✅ Block rate analysis
  • ✅ Detailed test results table

🚀 Quick Start

Generate HTML Report After Testing

# Run test with HTML report generation
python3 waf_tester.py \
  -t https://example.com \
  -p payloads/xss/basic.json \
  --html-report

# Output:
# - report.json (raw data)
# - report.html (professional HTML report with Dali Security branding)

Generate Standalone Report from Existing JSON

from report_generator import SecurityReportGenerator

# Load your test results
import json
with open('report.json') as f:
    test_results = json.load(f)

# Generate HTML report
generator = SecurityReportGenerator()
generator.generate_html_report(test_results, 'security_report.html')

📋 Report Sections

1. Header

  • Dali Security logo
  • Report title and date
  • Target URL and test metadata
  • Security score (0-100)

2. Executive Summary

  • Total payloads tested
  • Payloads blocked (✓)
  • Payloads bypassed (⚠️)
  • Security effectiveness percentage
  • Visual progress bar

3. Vulnerabilities Discovered

  • Severity levels: Critical, High, Medium, Low
  • Category breakdown (XSS, SQLi, Command Injection, etc.)
  • Bypassed payload count per category
  • Example payloads that bypassed security
  • Vulnerability descriptions

4. Payload Analysis by Category

  • Detailed table with:
    • Category name
    • Total payloads tested
    • Blocked count
    • Bypassed count
    • Block rate percentage
    • Status badge (Excellent/Good/Needs Attention)

5. Security Recommendations

  • Priority-based recommendations (High/Medium/Low)
  • Specific fix guidance for each vulnerability
  • Actionable steps to improve security
  • Best practices for each category

6. Detailed Test Results

  • Complete test log
  • Payload-by-payload results
  • HTTP status codes
  • Block/bypass status
  • Category classification

🎨 Report Customization

Severity Levels

The report automatically assigns severity based on vulnerability type:

Vulnerability Severity Color
SQL Injection Critical Red
Command Injection Critical Red
XSS High Orange
XXE High Orange
SSRF High Orange
SSTI High Orange
Path Traversal Medium Yellow
Open Redirect Medium Yellow
CRLF Injection Medium Yellow

Security Score Calculation

Security Score = (Blocked Payloads / Total Payloads) × 100

- 95-100: Excellent ✅
- 80-94: Good ⚠️
- Below 80: Needs Attention ❌

💡 Understanding the Report

What Does "Blocked" Mean?

A payload is considered blocked if:

  • HTTP status code is 403 (Forbidden)
  • HTTP status code is 406 (Not Acceptable)
  • HTTP status code is 503 (Service Unavailable)
  • Connection error/timeout occurs

What Does "Bypassed" Mean?

A payload bypassed security if:

  • HTTP status code is 200 (OK)
  • HTTP status code is 301/302 (Redirect)
  • Any other non-blocking status code

Interpreting Block Rate

  • 95%+: Excellent security posture
  • 80-94%: Good, but improvements needed
  • Below 80%: Critical security gaps detected

🔍 Example Recommendations

Critical: SQL Injection

Priority: HIGH
Issue: 15 SQL injection payloads bypassed security controls.

Recommended Action:
- Use parameterized queries/prepared statements
- Implement input validation
- Apply principle of least privilege to database accounts
- Enable SQL injection protection in WAF

High: Cross-Site Scripting (XSS)

Priority: HIGH
Issue: 23 XSS payloads bypassed detection.

Recommended Action:
- Implement Content Security Policy (CSP)
- Use output encoding
- Sanitize user input
- Enable XSS protection headers

Medium: Path Traversal

Priority: MEDIUM
Issue: 8 path traversal payloads bypassed security.

Recommended Action:
- Implement strict path validation
- Use chroot jails
- Avoid user input in file operations
- Whitelist allowed directories

📊 Sample Report Output

Executive Summary Example

Target: https://example.com
Duration: 5 minutes 32 seconds
Security Score: 87/100

Total Payloads Tested: 100
Payloads Blocked: 87 ✓
Payloads Bypassed: 13 ⚠️

Security Effectiveness: 87%

Vulnerability Summary Example

Found 3 vulnerability categories:

[CRITICAL] SQL Injection
- Bypassed Payloads: 5
- Description: SQL Injection vulnerabilities allow attackers 
  to manipulate database queries and access sensitive data.
- Example: ' OR '1'='1' --

[HIGH] Cross-Site Scripting (XSS)
- Bypassed Payloads: 6
- Description: XSS vulnerabilities allow attackers to inject 
  malicious scripts into web pages.
- Example: <img src=x onerror=alert(1)>

[MEDIUM] Path Traversal
- Bypassed Payloads: 2
- Description: Path Traversal vulnerabilities allow access 
  to files outside the intended directory.
- Example: ../../etc/passwd

🎯 Use Cases

1. Security Audits

Generate professional reports for clients showing:

  • Current security posture
  • Identified vulnerabilities
  • Remediation recommendations
  • Before/after comparisons

2. Compliance Reporting

Document security testing for:

  • PCI DSS compliance
  • SOC 2 audits
  • ISO 27001 certification
  • Internal security reviews

3. WAF Tuning

Use reports to:

  • Identify WAF rule gaps
  • Prioritize rule updates
  • Track improvement over time
  • Validate configuration changes

4. Penetration Testing

Professional deliverables for:

  • Client presentations
  • Executive summaries
  • Technical deep-dives
  • Remediation tracking

🛠️ Advanced Usage

Custom Report Data

from report_generator import SecurityReportGenerator

# Create custom test results
custom_results = {
    'target': 'https://myapp.com',
    'duration': '10 minutes',
    'results': [
        {
            'category': 'xss',
            'payload': '<script>alert(1)</script>',
            'blocked': False,
            'status_code': 200,
            'description': 'Basic XSS payload'
        },
        # ... more results
    ]
}

# Generate report
generator = SecurityReportGenerator()
generator.generate_html_report(custom_results, 'custom_report.html')

Batch Report Generation

# Test multiple targets and generate reports
for target in target1.com target2.com target3.com; do
  python3 waf_tester.py \
    -t https://$target \
    -p payloads/xss/ \
    -o ${target}_report.json \
    --html-report
done

📧 Sharing Reports

Email to Stakeholders

The HTML report is self-contained and can be:

  • Emailed directly
  • Uploaded to cloud storage
  • Shared via collaboration tools
  • Printed for physical delivery

Integration with Tools

  • Upload to Jira/GitHub Issues
  • Attach to Slack/Teams messages
  • Store in documentation systems
  • Archive in compliance repositories

🎨 Report Styling

The report uses:

  • Modern gradient design (purple/blue theme)
  • Responsive layout (mobile-friendly)
  • Professional typography (system fonts)
  • Color-coded severity (red/orange/yellow/green)
  • Print-optimized CSS (clean printouts)

🔒 Security & Privacy

Data Handling

  • Reports are generated locally
  • No data sent to external servers
  • All processing happens on your machine
  • Full control over report distribution

Sensitive Information

The report includes:

  • Target URLs
  • Test payloads
  • Response codes
  • Timestamps

Recommendation: Treat reports as confidential and share only with authorized personnel.

📝 Example Commands

Basic HTML Report

python3 waf_tester.py \
  -t https://example.com \
  -p payloads/xss/basic.json \
  --html-report

Comprehensive Test with Report

python3 waf_tester.py \
  -t https://example.com \
  -p payloads/ \
  --max 100 \
  --delay 1 \
  -o full_audit_report.json \
  --html-report

Generate Sample Report

python3 report_generator.py
# Opens sample_security_report.html

🎉 Benefits

For Security Teams

  • Professional deliverables
  • Time-saving automation
  • Consistent reporting format
  • Actionable recommendations

For Management

  • Executive summaries
  • Clear security metrics
  • Risk prioritization
  • Compliance documentation

For Clients

  • Professional presentation
  • Easy-to-understand findings
  • Clear remediation steps
  • Progress tracking

🚀 Next Steps

  1. Run your first test with --html-report flag
  2. Review the generated HTML report in your browser
  3. Share with stakeholders as needed
  4. Implement recommendations from the report
  5. Re-test and compare results over time

📞 Support

For questions or issues with report generation:

  • Check the report_generator.py source code
  • Review sample_security_report.html for examples
  • Ensure all test results include category and status_code fields

Generated by Fray
Powered by Dali Security | Professional Security Testing Platform