In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including…

Creating a custom password dictionary for password spraying, while technically possible, would involve further active exploitation of the discovered vulnerability and is not the best next action immediately after discovery, which should focus on documentation and reporting.

Recommending a password manager is a good long-term solution, but it's a remediation step and not the immediate action to take after discovering a critical vulnerability during testing; documentation comes first.

Recommending password complexity rules is a valid remediation, but it addresses a symptom (weak passwords) rather than the root cause (unprotected repository) and is a recommendation to be included in the report, not the immediate next action after discovery.

The discovery of cleartext usernames, passwords, and sensitive employee data in an unprotected file repository is a significant security vulnerability. Documenting this finding accurately and immediately in the penetration-testing report is crucial for the client to understand the risk and prioritize remediation. This action adheres to the ethical guidelines of a penetration test, ensuring findings are reported without further exploitation.