If you have been doing penetration testing for any length of time, you probably have a personal database of vulnerability descriptions, recommendations, and other text snippets you commonly inject into various places of your reports. What if, Instead of keeping these in separate files on various computers, they were all included in your reporting software?!! 🤯
Faction is a pentest reporting tool that IS your database for global boilerplates, default vulnerability templates, and just about anything else you can imagine (well…sorta 🤔). Let’s walk through how this is done.
Vulnerability Templates
Let’s start with the obvious…. Faction includes over 75 default vulnerability templates when you start. These vulnerability templates include descriptions and recommendations that are fully customizable by you for all the common vulnerabilities like XSS and SQL Injection. You can start with Faction’s Default templates or upload your own as described here.
When adding a vulnerability in Faction, type the name of the vulnerability in the title and Faction will search your templates and show the results in the UI as shown below:
Once you select the vulnerability template name, Faction will automatically populate the severity of the finding, the description, and the recommendation. Something that would have taken you 30 min to an hour to complete by hand is now done in a few seconds!
These are fully editable in the Default Vulnerabilities section of Faction. You can add new ones, update the pre-packaged ones, or delete them all and upload your own with the Faction API.
Assessment Templates
Faction has the option of creating global and personal boilerplates that you can easily add to different sections of your reports. Global templates are shared with everyone while personal templates are only available to you. These are used in Executive Summaries, Risk Assessments, or Scoping Sections of your pentest report.
Global Assessment Templates
In Faction, Navigate to Templates -> Assessment Templates. Here you have the option to create text that will be available to all team members on the platform. This is useful for creating things like different high-level summaries for different report types, adding common risk recommendations, or guidance on prioritization of findings.
Notice you can include most Faction variables like “severity counts” and “project names” in your templates. These will be auto-populated in the generated report.
As the security assessor, you can easily add these to different sections of your report. Below is a screen-share of using Global Templates in your reports.
User Assessment Templates
User Assessment Templates work the same as the Global Assessment Templates but are specific to your user account. This allows you to add your own flare to a report that you might not be ready to share with the rest of the team.
To add a User Assessment Template just start typing into any of Faction’s text editors and then click the Save button in the Template section on the right. Note that User Assessment Templates have a different icon beside them in the Template List.
Below is a walk through of how you would add User templates to save and later recall user-defined boilerplate text.
Conclusion
Now you have everything you need to know to start automating your boilerplate text into your pen-testing reports with Faction. You can find more information on Faction at https://www.factionsecurity.com.
You can download Faction for Free on Github: https://github.com/factionsecurity/faction
Originally published on Medium .
