Legal Documentation and Report Writing
What the exam tests
Legal documentation and report writing tests whether you can turn technical work into a defensible deliverable. The exam expects authorization checks, scope discipline, evidence handling, and a report that both executives and technicians can act on.
Core rules and concepts
- Confirm written authorization, scope, time window, and rules of engagement before any active test; note excluded hosts and prohibited actions.
- Record every action with timestamp, source IP, target, command, and result. Screenshots need captions that state what they prove.
- Structure the report: executive summary, scope and methodology, findings ranked by risk, technical evidence, remediation, and appendices.
- Write findings with a title, affected asset, description, reproduction steps, impact, evidence, CVSS vector, and remediation.
- Separate confirmed findings from observations; do not inflate severity to match a narrative.
Worked example
You compromise a Kerberoastable service account and reuse it on a file server. The finding title is 'Kerberoastable service account permits privilege escalation.' Evidence includes the GetUserSPNs.py request, the cracked password (redacted), and the NetExec validation. Impact states that any domain user can request the ticket and crack it offline. Remediation: rotate the password, use a managed service account, and remove unnecessary SPNs. CVSS reflects network access and high confidentiality impact.
Traps
Missing dates or scope references, unreadable screenshots, findings without reproduction steps, remediation that says 'patch the system' with no specificity, and failing to redact credentials in the final report. Also: claiming a full domain compromise when you only obtained a workstation.