Mastering Kali Linux for Web Penetration Testing

Avoiding surprises with constant contact

The first thing we should plan on and commit to with the customer is a cadence of status reports and tag-up meetings. Even in black-box tests, we can usually give progress reports with an advanced set of findings to help apprise them of our progress. This can be presented according to the milestones included in a SOW, in terms of any turns or adaptations to the plan as dictated by the target environment. However it is done, reports should include significant results or impressions, both good and bad. In black-box testing especially, the entire stakeholder community (us and them) should be prepared for some variability, as each prior phase of testing will often dictate the scope of the next phase.