Below the Waterline Stage 3 - Writing Red Team Reports Properly

Welcome back to my Below the Waterline series. In this part I'm going to dive into reporting, and more specifically getting the right point across to the right audience, because finding something technically interesting is only half the job. You can find a brilliant attack path, prove it beyond any doubt, write it up, talk it through in a meeting and still change absolutely nothing if the report doesn't explain why it matters and what somebody should actually do about it. This is especially true in red teaming, where people tend to be technically strong but don't always have the knowledge to explain business impact.Most red team courses and blog posts skip over reporting because it isn't seen as a technical skill, and to be honest, it's nowhere near as fun to demo as an exploit or a clever route to an objective.In reality reporting is a lot closer to translation. You're pulling apart what happened during an engagement and explaining it to people who weren't sat next to the operator…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town