Web Recon & Security Report Builder
Turn your scope, recon lists and findings into a clean, escaped report as Markdown and as a self-contained HTML page, with CVSS scores and secret masking.
Runs in your browser Your input never leaves your device.
Your report stays in this browser: nothing is uploaded. By default nothing is saved either, so closing the tab loses it. Tick "Keep a draft in this browser" below if you want it kept, and download the report when you are done.
1. Engagement
2. Scope and authorization
3. Reconnaissance results (paste lists, one per line)
4. Findings
Severity can come from a CVSS vector (3.0 or 3.1). If the vector and the severity you chose disagree, you get a warning.
5. Notes
Everything you type is treated as plain text and escaped in both formats, so nothing in a finding can change the structure of the report. Check the report before you send it: masking finds known secret formats, not every sensitive detail.
Report a problem with this tool
About this tool
A recon or testing engagement ends with a report, and assembling one from notes is slow. This builder takes the pieces and writes the document. Enter the report title, client, author and testing dates, an executive summary, the in-scope and out-of-scope lists and the authorization statement, tick the methodology steps you used, and paste recon results as lists (subdomains and hosts, endpoints, technologies, open ports). Then add findings: a title, a severity or a CVSS 3.0 or 3.1 vector, the affected asset, a CWE, a description, impact, numbered steps to reproduce, remediation, references and evidence. The report is written as Markdown and as a self-contained HTML page you can print or save as PDF. Findings are ordered from critical to informational (by CVSS score within a severity), numbered F-01, F-02 and so on, and summarised in a severity table and a findings table, with a contents list. If a CVSS vector gives a different severity from the one you chose you get a warning, and so you do for a missing authorization statement, empty descriptions or no remediation. Dates, vectors, CWE numbers and links are validated, and references must be plain http or https URLs. Everything you type is treated as plain text and escaped in both formats, so a finding cannot change the report's structure or inject HTML or script, even if you paste hostile text. The output was parsed with a Markdown engine and an HTML parser on reports full of hostile text to prove it. Values that look like secrets (tokens, keys) in any field, including titles, scope lists and reference links, are detected with the secret scanner's rules and replaced in the output by a short [masked: type] note by default, with a warning that names the finding or field; masking finds known formats, so read the report before you send it. Reports are limited to 300 findings and a few megabytes of text. Nothing is uploaded. Optionally keep a draft in this browser (it is stored unmasked, in plain text, and you can clear it with one button). The Markdown contents list links to GitHub-style heading anchors; the HTML export has its own anchors.
How to use it
- Fill in the engagement, scope and authorization, then tick the methodology you followed.
- Paste recon lists and add each finding with its severity or CVSS vector, steps, impact and remediation.
- Read the warnings: severity mismatches, missing authorization and any secrets that were masked.
- Copy the Markdown or download it as .md or .html, check it, and send it.
Common problems
- The report is empty and a message appears
- Fix the listed problem first: a missing title, an impossible date, an unreadable CVSS vector, a CWE that is not like CWE-79, or a reference that is not a plain http or https URL.
- A value in my evidence was replaced by a [masked: …] note
- It looked like a secret and was replaced by a masked note. Untick the masking option only if you are sure the report stays private.
- I lost my draft
- Drafts are kept only if you tick the option, and only in this browser. Download the .md or .html file when you finish.