Are you a penetration tester? Do you hate writing reports? Yeah, me too. Most of us got into this to break things, not to spend the last three days of an engagement turning notes into paragraphs.
In the video below, I walk through the new AI prompt features in Faction 2.0. The short version: Faction can now write your vulnerability descriptions, recommendations, and executive summary for you, and it does it using prompts that you control, so the output sounds like you and fits your report format.
Start with what you actually do during a test
When I’m in the middle of a pen test, I’m not writing descriptions and recommendations. I save that for the end. I’m finding things and jotting down my steps to reproduce so I don’t lose them, usually in a text editor like obsidian. So in the video I do just that but inside Faction’s details section. I quickly add all evidence that I successfully exploit the vulnerability.
Generate the description from your details
This is where the AI integration comes in. With the details filled in, I hit the AI prompt to generate the description, and what comes back is based on those specific steps to reproduce. It’s not a generic boilerplate XSS paragraph you paste into every report. It’s a description of the thing I actually found, written in terms the developer can act on.
The prompt can also go out and search the web. I have mine set up to pull relevant references from OWASP, MITRE, and NIST and drop them into the description. So with a couple of clicks I’ve got a pretty robust write-up with real links instead of a placeholder.
Then I do the same thing for the recommendation. One thing worth noticing: the recommendation is generated from the details (steps to reproduce), not from the description so the recommendation is based specifically on what we found.
What’s happening under the hood
Faction runs a embedded MCP server inside the assessment. It has access to every vulnerability in that assessment, so when you ask it to do something with a details, description, or recommendation field, it can pull that content in and write against it. That’s why the output stays grounded in what you actually found instead of drifting into generic advice.
Making it sound like you
Maybe you don’t like the style. Maybe you want one paragraph instead of two, or you don’t want references at all. All of that lives under Administration > AI Configuration.
From there you can pick different models for different prompts, and you can edit every prompt directly. In the video I open up the “description from details” prompt and read through it. Mine tells it to:
- Take the details section (my steps to reproduce) and write a one to two paragraph description of the vulnerability in terms the application developer can understand
- Be brief but thorough
- Search the web and add references from OWASP, MITRE, and NIST, and if there’s no good link, leave it out rather than make one up
- Skip headers, because they mess with how the report flows
- Don’t add a recommendation, because that belongs in a different section
You also choose the model per prompt. A more powerful model gives better output at a higher token burn. A cheaper one is fine for a lot of this. It’s your call based on how happy you are with the results.
It’s straightforward, and it’s fully customizable for whatever kind of reporting you do.
Automating the tedious part: the Executive Summary
The description and recommendation are nice, but the executive summary is the part everybody dreads. So I round out the XSS finding (CVSS score, category, likelihood, and yes, the AI can generate the title too) and then add a handful more findings with the templating engine so there’s actually something to summarize: SQL injection, an unrestricted file upload, a backdoor on the server.
Then I go to the executive summary and generate it with the same AI config. My prompt tells it to:
- Write a one to two paragraph introduction to the assessment and what was found
- List every issue in descending order of severity
- Prioritize how to mitigate them
- Lay out a mitigation plan: this is what you fix first because it’s the highest risk, then move on to these
The point is to give the reader a clear picture of how to approach the report and address the findings, without mevery time.
After that I generate the report, let it cook, and preview it. Executive summary, every finding with its details he chart plotting it all out. Ready to ship.
Try it yourself
If you want to try this, we have an OWASP version of Faction that is fully open source and fully free You can grab it from our GitHub links below
Originally published on Medium .
