JS Web Design Services logoJS Web Design ServicesSecurity & Recovery
Sample Report · Specimen Engagement

See exactly what you'll receive.

Not a scanner printout. A client-ready report with an executive summary, severity-rated findings, reproducible evidence, attack-chain analysis and a prioritised fix plan. Below is a specimen engagement — fully anonymised — plus the full report itself.

Open the full sample reportRequest your own scan
Fully anonymised specimenWeb + PDF deliveredClient reports stay private
Web Application Penetration TestOWASP WSTG v4.2 · Specimen report
Overall riskCRITICAL
Findings18 · 2 Critical · 4 High
Attack chains mapped5
Remediation roadmapIncluded
What's inside

Every report includes

The same structure whether it's a routine audit or a live incident — so it's readable by your team and actionable on day one.

  • Executive summary written for decision-makers
  • Visual “at a glance” risk dashboard
  • Severity-rated findings with CVSS vectors & CWE
  • Reproducible evidence for every finding
  • Attack-chain analysis — how findings combine
  • CVE cross-reference with patch status
  • Positive security controls already working
  • Prioritised remediation roadmap with effort estimates
Case study

Anatomy of a penetration test

Membership organisation · WordPress + e-commerce18 findings · 2 critical

A commercial security suite was installed and doing its job — hidden login, user enumeration blocked. It made no difference: two unauthenticated flaws in third-party plugins bypassed the application layer entirely.

Unauthenticated file upload → RCE

A plugin validated uploads by the MIME type in the request rather than the file itself. A .php file landed in a web-readable directory — remote code execution, no login required.

Unauthenticated SQL injection

A booking endpoint concatenated a parameter straight into a WHERE clause. Confirmed with a timing oracle only — no data extracted, no rows touched.

Abandoned plugin still active

One plugin had received no update in over three years and auto-updates were switched off. Anything disclosed against it stays exploitable forever.

Admin username exposed, no 2FA

Enumeration was blocked on the REST API but not on author archives — and Application Passwords were enabled with no second factor.

The outcome

What the client walked away with

  • 18 findings with CVSS vectors and CWE mapping
  • 2 criticals confirmed safely — benign proof-of-concept, removed after verification
  • 5 attack chains showing how moderate issues combine
  • 17-step roadmap ordered by urgency, with effort estimates
Read the full report Get this for my site
18
Findings documented
2
Critical severity
5
Attack chains mapped
17
Step fix roadmap
Engagement types

Reports we deliver

Emergency malware cleanup

Site is infected, redirecting visitors, or serving spam. Report documents what was found, the vector, and every change made.

Malware removal

Blacklist recovery

Google flagged the site. Report covers the malicious code behind the flag and the review submission trail.

Blacklist removal

Scheduled VAPT

Proactive OWASP-aligned assessment with CVSS-scored findings — suitable for compliance and client assurance.

Penetration testing
FAQ

About our reports

Is the sample report from a real assessment?
It is an illustrative specimen — a composite drawn from real engagement work rather than a transcript of any single client. No client name, domain, IP address, username, email address or token appears anywhere in it. The methodology, evidence standard and remediation format are exactly what we deliver.
Will my report look like this?
Yes — same structure and depth. The number and severity of findings varies with your site; many assessments turn up no criticals at all. Every report includes the executive summary, severity-rated findings with CVSS, evidence, attack-chain analysis and a prioritised remediation roadmap.
Why does the report list things that are already secure?
A report that only lists problems gives an unbalanced picture. We include a Positive Security Controls section so you can see what is already working — useful for your own stakeholders, auditors and insurers.
What is attack-chain analysis?
Individually moderate findings often combine into a serious path. Rather than a flat list, we show how (for example) a disclosed database schema plus an injectable endpoint leads straight to password hashes — so you fix the chain, not just the symptoms.
Do you publish client reports?
Never. Live client reports are private and delivered through an encrypted, password-protected link that only you and your team can open. This public specimen exists purely so prospects can see our format before engaging.
Can I get the report as a PDF?
Yes. Every engagement is delivered as both a shareable web report and a branded, print-ready PDF — with a cover page, table of contents and page numbering — that you can forward to stakeholders, insurers or auditors.

Want a report like this for your site?

Start with a non-destructive security scan and get the same clarity — findings, evidence, and exactly what to fix first.

Request a Security ScanOpen the full sample report
Security Scan & AuditWordPress Malware RemovalPenetration Testing (VAPT)