From 9243f759627f873b1108fd86171038a8e7fc6246 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stefan=20Gr=C3=B6nke?= Date: Wed, 10 Jun 2026 10:30:37 +0000 Subject: [PATCH 1/2] fix(dtd): correct schema gaps so valid documents validate The XSD schemas were stricter and less complete than the tooling and templates, so valid PenText documents failed XSD validation. Align the schemas with what the XSLT actually supports: - common.xsd: remove the duplicate global 'location' element. - pentestreport.xsd: make finding @prefix optional, make optional, and allow in technicaldescription, section and appendix. - offerte.xsd: add the placeholder elements the stylesheet resolves (p_draftdue, p_duration, p_location, p_participants) and allow participants, location and duration inside activityinfo. Schema-only change; every edit is a relaxation or addition, so documents that validated before still validate. --- dtd/common.xsd | 1 - dtd/offerte.xsd | 7 +++++++ dtd/pentestreport.xsd | 6 +++++- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/dtd/common.xsd b/dtd/common.xsd index 8a8178d..f24510f 100644 --- a/dtd/common.xsd +++ b/dtd/common.xsd @@ -644,7 +644,6 @@ - diff --git a/dtd/offerte.xsd b/dtd/offerte.xsd index dc4cc2b..f4f0a56 100644 --- a/dtd/offerte.xsd +++ b/dtd/offerte.xsd @@ -60,6 +60,9 @@ + + + @@ -276,6 +279,10 @@ + + + + diff --git a/dtd/pentestreport.xsd b/dtd/pentestreport.xsd index 2ea25c2..46a4495 100644 --- a/dtd/pentestreport.xsd +++ b/dtd/pentestreport.xsd @@ -130,6 +130,7 @@ + @@ -164,6 +165,7 @@ + @@ -308,7 +310,7 @@ - + @@ -324,6 +326,7 @@ + @@ -366,6 +369,7 @@ + From 159ec778ce48902f24e0e3bfb16b41e8df6a81b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stefan=20Gr=C3=B6nke?= Date: Wed, 10 Jun 2026 10:42:54 +0000 Subject: [PATCH 2/2] fix(examples): make example documents schema-valid and resolvable Resolve the examples' xi:includes via symlinks to source/, and fix the remaining schema violations: - exampleinvoice: denomination usd - examplereport: drop stale `` and unused `pieHeight`; add required `@number` - examplequickscope: drop redundant ``; give `` start/end --- doc/examples/client_info.xml | 1 + doc/examples/examplefinding.xml | 16 +- doc/examples/examplegenericdocument.xml | 214 +++++---- doc/examples/exampleinvoice.xml | 62 +-- doc/examples/exampleofferte.xml | 155 +++---- doc/examples/examplequickscope.xml | 114 ++--- doc/examples/examplereport.xml | 577 +++++++++++++----------- doc/examples/snippets | 1 + 8 files changed, 618 insertions(+), 522 deletions(-) create mode 120000 doc/examples/client_info.xml create mode 120000 doc/examples/snippets diff --git a/doc/examples/client_info.xml b/doc/examples/client_info.xml new file mode 120000 index 0000000..33d9d46 --- /dev/null +++ b/doc/examples/client_info.xml @@ -0,0 +1 @@ +../../source/client_info.xml \ No newline at end of file diff --git a/doc/examples/examplefinding.xml b/doc/examples/examplefinding.xml index 134ec11..3336863 100644 --- a/doc/examples/examplefinding.xml +++ b/doc/examples/examplefinding.xml @@ -1,18 +1,20 @@ - - + + Example Title - + A specialized piece of malware can be crafted to bypass local anti-virus software and to cheat during tests. - + The student desks run antivirus software that will prevent many common remote access and malware tools that students may use to try and cheat. It is however still possible to use common tools to evade detection by the anti-virus software. Note that to run the custom malware, a student needs to have found an arbitrary file execution bug first. - + To exploit this vulnerability, we used 'veil-evasion' to build an undetected Meterpreter reverse TCP executable that connects back to an external computer and allows for remote access. See https://www.veil-framework.com/veil-tutorial/ for details. - + A student may use this malware to have an accomplice at a remote location assist in the test by viewing screenshots of the student desk and reading/modifying files on the student desk. The setup for this can be done very quickly - before the test even starts - and will leave no obvious visible clues that something fishy has happened. - + Allow only a set of whitelisted programs to be executed. Base restrictions on file contents, e.g. by comparing agains one or more strong file hashes. diff --git a/doc/examples/examplegenericdocument.xml b/doc/examples/examplegenericdocument.xml index 7c1f67b..8a1d573 100644 --- a/doc/examples/examplegenericdocument.xml +++ b/doc/examples/examplegenericdocument.xml @@ -1,101 +1,123 @@ - - - - Generic Document - It can be about ANYTHING you want! - - - Melanie Rieback - - - Melanie Rieback - Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, + + + + Generic Document + It can be about ANYTHING you want! + + + Melanie Rieback + + + Melanie Rieback + Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, who is also the co-founder/CEO of Radically Open Security. - - - Confidential - - - Patricia Piolon - Initial draft - - - Ernest Hemingway - Structure & contents revision - - - Patricia Piolon - Added some stuff - - - Patricia Piolon - JRR Tolkien - Revision - - - Patricia Piolon - Revision - - - Arthur Conan Doyle - Finalizing - - - - - - - -
- This is a generic document -
- This is a subsection -

In this document we describe anything that is not an offer, invoice or pentest.

-

It is as generic as generic can be.

-
-
- Some more info -

You can only use the most general of elements in this document (all the elements borrowed from html + monospace, code, section, appendix and title, basically).

-

Only the company-related placeholders work!

-
-
- - -
- Anything else? -

Mmmm no, that's it.

- - -
This is a table
It contains bogus information.
- -
- List example -

This is a list:

- -

You get the idea

-
-
- other elements -

Command:

- 
$ this is a pre (for command line entries)
- -

Outcome:

- 
This       is      where
+      
+    
+    Confidential
+    
+      
+        Patricia Piolon
+        Initial draft
+      
+      
+        Ernest Hemingway
+        Structure & contents revision
+      
+      
+        Patricia Piolon
+        Added some stuff
+      
+      
+        Patricia Piolon
+        JRR Tolkien
+        Revision
+      
+      
+        Patricia Piolon
+        Revision
+      
+      
+        Arthur Conan Doyle
+        Finalizing
+      
+    
+    
+  
+
+  
+
+  

+    This is a generic document
+    

+      This is a subsection
+      
In this document we describe anything that is not an offer, invoice or pentest.

+      
It is as generic as generic can be.

+    

+    

+      Some more info
+      
You can only use the most general of elements in this document (all the elements borrowed from html + monospace, code, section, appendix and title, basically).

+      
Only the company-related placeholders work!

+    

+  

+
+
+  

+    Anything else?
+    
Mmmm no, that's it.

+
+    
+      
This is a table
It contains bogus information.

+
+    

+      List example
+      
This is a list:

+      
+      
You get the idea

+    

+    

+      other elements
+      
Command:

+      
$ this is a pre (for command line entries)

+
+      
Outcome:

+      
This       is      where
 you would write the
 output
 I
 guess.

-                        
-                        
Let's have a link pointing to  at this point.

-                        
-                

-                
-        

-        
-                Did we forget anything
-                
Nope.

-        
-
\ No newline at end of file
+
+      

+        Let's have a link pointing to
+        
+        at this point.
+      

+
+
+ +
+ + Did we forget anything +

Nope.

+ + diff --git a/doc/examples/exampleinvoice.xml b/doc/examples/exampleinvoice.xml index d575656..31addd2 100644 --- a/doc/examples/exampleinvoice.xml +++ b/doc/examples/exampleinvoice.xml @@ -1,30 +1,34 @@ - - - - - - - - - 10-day penetration test Sitting Duck - 7000 - - - Something else - 2000 - - - - - An additional cost without vat - 1000 - - - An additional cost with vat - 1000 - - + + + + + + + + + 10-day penetration test Sitting Duck + 7000 + + + Something else + 2000 + + + + + An additional cost without vat + 1000 + + + An additional cost with vat + 1000 + + diff --git a/doc/examples/exampleofferte.xml b/doc/examples/exampleofferte.xml index 900a7b2..a5558f4 100644 --- a/doc/examples/exampleofferte.xml +++ b/doc/examples/exampleofferte.xml @@ -1,80 +1,83 @@ - - + - - quote - penetration testing services - - penetration test - - - target1.sittingduck.com - target2.sittingduck.com - FishInABarrel App - - - - - HotshotDevs Inc. - HotshotDevs - - Hotshot Dev Lawyer -
Silicon Valley St. 50
- 10000 - San Francisco - US - - - - 10 - - 20 - - 2018-01-01 - 2018-02-02 - - - 2018-03-03 - time-boxed - crystal-box - - 1000000 - - FishInABarrel - - - - - ROS Writer - - Initial draft - - - - - - - - - - - - - - - - - - - - - - - - - +> + + quote + penetration testing services + + penetration test + + + target1.sittingduck.com + target2.sittingduck.com + FishInABarrel App + + + + + HotshotDevs Inc. + HotshotDevs + + Hotshot Dev Lawyer +
Silicon Valley St. 50
+ 10000 + San Francisco + US + + + + 10 + + 20 + + 2018-01-01 + 2018-02-02 + + + 2018-03-03 + time-boxed + crystal-box + + 1000000 + + FishInABarrel + + + + + ROS Writer + + Initial draft + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/doc/examples/examplequickscope.xml b/doc/examples/examplequickscope.xml index 55fed40..8b66315 100644 --- a/doc/examples/examplequickscope.xml +++ b/doc/examples/examplequickscope.xml @@ -1,64 +1,64 @@ - - + - - - + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:noNamespaceSchemaLocation="../dtd/quickscope.xsd" +> + + + - - - - en - - pentest - - + + + + en + + pentest + + penetration testing services - - - - - Third Party BV - Third Party - - TP Waiver Rep -
TP Street 123
- 0001 XX - TP City - TP Country - - - + + Third Party BV + Third Party + + TP Waiver Rep +
TP Street 123
+ 0001 XX + TP City + TP Country + + + + - - target1.target.com - target2.target.com - - - 6 - - 12 - - time-boxed - - crystal-box - - - - TBD - - TBD - - - - AppToTest - - - 40000 + + target1.target.com + target2.target.com + + + 12 + + time-boxed + + crystal-box + + + + + TBD + TBD + + + TBD + + + + AppToTest + + + 40000 - + diff --git a/doc/examples/examplereport.xml b/doc/examples/examplereport.xml index 5fb5057..2fe965b 100644 --- a/doc/examples/examplereport.xml +++ b/doc/examples/examplereport.xml @@ -1,202 +1,237 @@ - + - - Penetration Test Report - - fishinabarrel.sittingduck.com - - - 4 - 4 - - TBD - TBD - - bla - something - black-box - - - - + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + findingCode="SID" + xsi:noNamespaceSchemaLocation="../dtd/pentestreport.xsd" +> + + Penetration Test Report + + fishinabarrel.sittingduck.com + + + 4 + + TBD + TBD + + bla + something + black-box + + + + - - - Melanie Rieback - - - Melanie Rieback - Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, + + + Melanie Rieback + + + Melanie Rieback + Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, who is also the co-founder/CEO of Radically Open Security. - - - - Melanie Rieback - Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, + + + + Melanie Rieback + Melanie Rieback is a former Asst. Prof. of Computer Science from the VU, who is also the co-founder/CEO of Radically Open Security. - - - Aristotle - Greek philosopher and scientist born in the Macedonian city of Stagira, Chalkidice, on the northern periphery of Classical Greece. - - - George Boole - English mathematician, philosopher and logician. Works in the fields of differential equations and algebraic logic, and is now best known as the author of The Laws of Thought. - - - William of Ockham - English Franciscan friar and scholastic philosopher and theologian. Considered to be one of the major figures of medieval thought. At the centre of some major intellectual and political controversies. - - - Ludwig Josef Johann Wittgenstein - Austrian-British philosopher who works primarily in logic, the philosophy of mathematics, the philosophy of mind, and the philosophy of language. - - - - Confidential - - - Patricia Piolon - Initial draft - - - Ernest Hemingway - Structure & contents revision - - - Patricia Piolon - Added threat levels and recommendations - - - Patricia Piolon - JRR Tolkien - Revision - - - Patricia Piolon - Revision - - - Arthur Conan Doyle - Finalizing - - - - + + + Aristotle + Greek philosopher and scientist born in the Macedonian city of Stagira, Chalkidice, on the northern periphery of Classical Greece. + + + George Boole + English mathematician, philosopher and logician. Works in the fields of differential equations and algebraic logic, and is now best known as the author of The Laws of Thought. + + + William of Ockham + English Franciscan friar and scholastic philosopher and theologian. Considered to be one of the major figures of medieval thought. At the centre of some major intellectual and political controversies. + + + Ludwig Josef Johann Wittgenstein + Austrian-British philosopher who works primarily in logic, the philosophy of mathematics, the philosophy of mind, and the philosophy of language. + + + + Confidential + + + Patricia Piolon + Initial draft + + + Ernest Hemingway + Structure & contents revision + + + Patricia Piolon + Added threat levels and recommendations + + + Patricia Piolon + JRR Tolkien + Revision + + + Patricia Piolon + Revision + + + Arthur Conan Doyle + Finalizing + + + + - + -
- Executive Summary -
- Introduction -

Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a +

+ Executive Summary +
+ Introduction +

Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a Penetration Test of the FishInABarrel Web Application to Radically Open Security BV (hereafter “ROS”). Sitting Duck has made this request to better evaluate the security of the application and to identify application level vulnerabilities in order to see whether the FishInABarrel Web Application is ready, security-wise, for production deployment.

-

This report contains our findings as well as detailed explanations of +

This report contains our findings as well as detailed explanations of exactly how ROS performed the penetration test.

-
-
- Scope of work -

The scope of the Sitting Duck penetration test was limited to the +

+
+ Scope of work +

The scope of the Sitting Duck penetration test was limited to the following target:

- -

The penetration test was carried out from a black box perspective: no + +

The penetration test was carried out from a black box perspective: no information regarding the system(s) tested was provided by Sitting Duck or FishInABarrel, although FishInABarrel did provide ROS with two test user accounts.

-
-
- Project objectives -

The objective of the security assessment is to gain insight into the +

+
+ Project objectives +

The objective of the security assessment is to gain insight into the security of the host and the FishInABarrel Web Application.

-
-
- Timeline -

The FishInABarrel Security Audit took place between January 14 and +

+
+ Timeline +

The FishInABarrel Security Audit took place between January 14 and January 16, 2015.

-
-
- Results in a Nutshell -

During this pentest, we found quite a number of different security +

+
+ Results in a Nutshell +

During this pentest, we found quite a number of different security problems – Cross-site Scripting (XSS) vulnerabilities, both stored and reflected, Cross-site Request Forgery (CSRF) vulnerabilities, information disclosures (multiple instances), and lack of brute force protection.

-
-
- Summary of Findings - - -
-
- Summary of Recommendations - - -
-
- Charts -
- Findings by Threat Level - -
-
- Findings by Type - -
+
+
+ Summary of Findings + + +
+
+ Summary of Recommendations + + +
+
+ Charts +
+ Findings by Threat Level + +
+
+ Findings by Type + +
- -
-
+ +
+
- + -
- Reconnaissance and Fingerprinting -

Through automated scans we were able to gain the following information about the +

+ Reconnaissance and Fingerprinting +

Through automated scans we were able to gain the following information about the software and infrastructure. Detailed scan output can be found in the sections below.

- - - - - - - -
Fingerprinted Information
Windows XP
Microsoft IIS 6.0
PHP 5.4.29
jQuery - 1.7.2
Mailserver XYZ
FTPserver ABC
+ + + + + + + +
Fingerprinted Information
+ Windows XP
+ Microsoft IIS 6.0
+ PHP 5.4.29
+ jQuery + 1.7.2
+ Mailserver XYZ
+ FTPserver ABC +
-
- Automated Scans -

As part of our active reconnaissance we used the following automated +

+ Automated Scans +

As part of our active reconnaissance we used the following automated scans:

- -

Of these, only the output of nmap turned out to be useful; consequently +

+

Of these, only the output of nmap turned out to be useful; consequently only nmap and output will be discussed in this section.

-
-
- nmap -

Command:

- 
$ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
+
+
+ nmap +

Command:

+ 
$ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
 fishinabarrel.sittingduck.com
-

Outcome:

- 
Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
+      
Outcome:

+      
Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
 Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
 Initiating ARP Ping Scan against 10.10.10.1 [1 port] at 15:43
 The ARP Ping Scan took 0.01s to scan 1 total hosts.
@@ -224,126 +259,154 @@ PORT     STATE SERVICE
 Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
 Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)

 
-                        
The scan revealed a very large number of open services on this machine,
-                                which greatly increases the attack surface; see  for
-                                more information on the security risk.

+      

+        The scan revealed a very large number of open services on this machine,
+        which greatly increases the attack surface; see
+        
+        for
+        more information on the security risk.
+      

 
-
+
-
+
-
- Findings +
+ Findings -

We have identified the following issues:

+

We have identified the following issues:

- - PHPInfo Disclosure - -

The phpinfo() function of the PHP language is readable, resulting + + PHPInfo Disclosure + +

The phpinfo() function of the PHP language is readable, resulting in a listing of all the runtime information of the environment, thus disclosing potentially valuable information to attackers.

- - -

This is where the good stuff goes. We give a detailed technical + + +

This is where the good stuff goes. We give a detailed technical description of the problem.

-

Illustrative picture of an evil hacker pondering dark deeds:

- - - -

This is where we explain how the sh*t is hitting the fan, +

Illustrative picture of an evil hacker pondering dark deeds:

+ + + +

This is where we explain how the sh*t is hitting the fan, exactly.

- - -

Here is where we write some tips to solve the problem.

- - + + +

Here is where we write some tips to solve the problem.

+ + - - A terrible XSS issue - -

A general description of the problem.

- - -

This is we go into great detail about the vulnerability.

- - -

This is where we explain why this vulnerability is a problem.

- - -

This is where we solve everything and the sun starts shining + + A terrible XSS issue + +

A general description of the problem.

+ + +

This is we go into great detail about the vulnerability.

+ + +

This is where we explain why this vulnerability is a problem.

+ + +

This is where we solve everything and the sun starts shining again.

- - + + - - A not quite so terrible XSS issue - -

A description of the problem.

- - -

Vulnerability described in detail.

- - -

Impact on security.

- - -

A ready solution.

- - -
+ + A not quite so terrible XSS issue + +

A description of the problem.

+ + +

Vulnerability described in detail.

+ + +

Impact on security.

+ + +

A ready solution.

+ + +
-
- Non-Findings -

In this section we list some of the things that were tried but turned out to be +

+ Non-Findings +

In this section we list some of the things that were tried but turned out to be dead ends.

- - FTP -

The server was running FTPserver ABC, the most recent version of this + + FTP +

The server was running FTPserver ABC, the most recent version of this particular piece of software. Anonymous login was turned off and no relevant vulnerabilities or exploits were found.

- - - Mail Server -

The server was running Mailserver XYZ, the most recent version of this + + + Mail Server +

The server was running Mailserver XYZ, the most recent version of this particular piece of software. No relevant vulnerabilities or exploits were found.

- - - SQL Code Injection -

The following parameters are not vulnerable to SQL injection.

-

All parameters have been checked manually.

- 
-file1.php
+    
+    
+      SQL Code Injection
+      
The following parameters are not vulnerable to SQL injection.

+      
All parameters have been checked manually.

+      
-file1.php
 -file2.php
 -file3.php
 

-                
-                
-                        Heartbleed
-                        
System was not vulnerable to heartbleed.

-                
-                
-                        Windows XP
-                        
The host is running Windows XP. As we all know, Windows XP is
+    
+    
+      Heartbleed
+      
System was not vulnerable to heartbleed.

+    
+    
+      Windows XP
+      
The host is running Windows XP. As we all know, Windows XP is
                                 bulletproof.

-                
-
-
- Conclusion -

In the course of this penetration test, we have demonstrated that the + +

+
+ Conclusion +

In the course of this penetration test, we have demonstrated that the FishInABarrel Web Application faces a range of security issues which makes it vulnerable to a number of different attacks. Vulnerabilities found included: cross-site scripting (both stored and reflected), cross-site request forgery, information disclosure and lack of brute force protection.

-

Our conclusion is that there are a number of things that FishInABarrel BV has to +

Our conclusion is that there are a number of things that FishInABarrel BV has to fix before Sitting Duck should use their software. A number of the security issues highlighted in this report have fairly simple solutions, but these should nevertheless be fixed before use of the FishInABarrel Web App continues.

-

We finally want to emphasize that security is a process – and this penetration +

We finally want to emphasize that security is a process – and this penetration test is just a one-time snapshot. Security posture must be continuously evaluated and improved. Regular audits and ongoing improvements are essential in order to maintain control of your corporate information @@ -351,9 +414,9 @@ Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB) our findings) will contribute meaningfully towards that end. Don't hesitate to let us know if you have any further questions or need further clarification of anything in this report.

-
- - Testing team - - +
+ + Testing team + + diff --git a/doc/examples/snippets b/doc/examples/snippets new file mode 120000 index 0000000..cf64389 --- /dev/null +++ b/doc/examples/snippets @@ -0,0 +1 @@ +../../source/snippets \ No newline at end of file