CMWAP example plans & reports
Learn the expected format: example plans (what you submit in your 90-minute window) and example reports and findings. These are illustrative โ your exam deliverables are your own work.
โ Back to CMWAPCMWAP Report โ template
CMWAP Web Application Penetration Test Report โ Template
Replace every
<placeholder>. Delete guidance lines in italics before delivery. This template mirrors the structure the CMWAP exam and real client engagements expect: findings that stand up to client scrutiny. Authorized testing only.
Cover
Web Application Penetration Test
Client: <Client / App name>
Prepared by: <Your name> โ Certified Modern Web App Pentester
Date: <YYYY-MM-DD> Version: 1.0 Classification: Confidential
1. Executive Summary
Two or three paragraphs for a non-technical reader. State what was tested, the overall risk posture, and the headline findings in business terms. Avoid jargon here.
| Metric | Value |
|---|---|
| Scope | <URLs / apps / APIs> |
| Testing window | <start> โ <end> |
| Total findings | <n> |
| Critical / High / Medium / Low / Info | <c> / <h> / <m> / <l> / <i> |
Key risks: bullet the 3-5 most important issues and their business impact (e.g. "Any user can read another customer's bank statements โ IDOR on /statements").
2. Scope & Rules of Engagement
- In scope:
<hosts, apps, API base URLs, user roles provided> - Out of scope:
<explicitly excluded> - Test accounts:
<roles/usernames used> - Constraints:
<no DoS, testing hours, rate limits, etc.> - Authorization: testing performed under
<engagement/authorization reference>.
3. Methodology
Testing followed the CMWAP methodology: Recon โ Understand โ Test โ Chain โ Report, aligned to OWASP WSTG. Vulnerability classes assessed: broken access control, injection/XSS, blind/OOB XSS, CSRF, SSRF, authentication & JWT, secret disclosure, and business logic. Tooling: Burp Suite, ffuf, jwt_tool, hashcat, nuclei, and an out-of-band collector.
4. Findings
One subsection per finding, ordered by severity (Critical first). Use the anatomy below for each.
4.x <Finding title โ concrete and specific>
| Field | Value |
|---|---|
| Severity | <Critical / High / Medium / Low / Info> |
| CVSS 3.1 | <score> โ <vector string> |
| Class | <e.g. Broken Access Control (IDOR)> |
| Affected | <endpoint / parameter / URL> |
| Status | Open |
Description. What the flaw is and why it exists, in plain language.
Steps to reproduce.
<step><step>http <exact request, including method, path, headers, body>http <relevant response showing the impact>Insert screenshot:evidence/<finding>-proof.pngโ the proof in one frame (URL + user + result).
Impact. Business impact first (what an attacker gains, what the client loses), then technical impact.
Remediation. Specific, actionable fix โ not just "validate input". e.g. "Enforce an object-ownership check server-side: verify session.user_id == statement.owner_id before returning /statements/{id}."
References. <OWASP WSTG / CWE / vendor docs>
5. Appendices
- A. Tooling & versions
- B. Full endpoint / parameter inventory
- C. Out-of-scope observations
- D. Retest results (after remediation)
The XSS Rat ยท CMWAP Course ยท Report template ยท Authorized / lab use only.