Globomantics plans on getting through a lot of pen tests every year, so it makes
sense to take some time to further automate their creation.
There are several free and paid for solutions available, and it's
worth trying some out to see which you prefer. Here, we're going to
look at an open‑source solution named PwnDoc, which helps to arrange
templates and produce reports.
It's got a web‑based interface, and it's reasonably intuitive. In this demo,
we're going to see PwnDoc in action. Kim has recreated the Carved Rock pen
test in PwnDoc to see if the tool can be useful to Globomantics. We're going
to see how report and finding templates are handled.
This tool uses similar placeholders to our original Word‑based
reports, so we'll see what they look like.
We're looking at this to see what it and other tools
can do to help improve reporting.
First, I look at how templates are stored in PwnDoc. We're in the web
interface, and we've gone into the Data menu at the top, then Custom
Data. Here, we see Vulnerability Categories,
These are all categories Kim has added, and she can add as many as she needs.
These categories are used by the finding templates that have
been created. Going into Vulnerabilities,
we can see some Kim has entered. Categories make it easier to choose the
template you need, so you can search based on a category such as Vulnerable
and Outdated Components and get only those in that category. Clicking Edit,
we can see the detail. There's a generic description, CVSS scores, and
scrolling down, some remediation advice and references, all of the things we
had in our Word‑based template, just in a different format for now. If we go
to Audits,
there's a list of pen tests that have been performed. For
now, just one for Carved Rock. Editing that, we see a list
of findings from the test.
The first is Unpatched Operating Systems. And for that, again,
we can see all of the detail from our original report,
including the images. In the DETAILS section, we also get to see the CVSS score,
which we can change according to the specific instance of the
vulnerability, and the remediation advice.
What about the report structure?
Going back to Data, we can see there are templates.
We've got one for web app tests and another for network tests,
which is what Kim used for the Carved Rock report.
Let's take a look at that template. First, we see that this
is still a Word document, which means it's easy to set the
format and edit it if we need to.
There's also a placeholder for name. PwnDoc takes named pieces of data that
it has and inserts them into the template, just as we would've done manually.
Scrolling down, we see more instances of that.
We're getting dates of the test and the name of the report
creator all coming from PwnDoc. There are placeholders for
things like the executive summary.
This looks a little technical, but once it's working,
you don't need to worry about it. Now for the best bit, the findings.
Again,
this looks a little technical, and we're not going to look at that too
deeply. Here, for every finding at a specific severity,
we're creating a row with a different color, so some of the summary
is going to be done for us. Further down, finally,
we see where the finding details will go.
All of the information in here is going to be added by
PwnDoc and given the format that we want. Every finding
will get a copy of this section.
Let's take a look at the report PwnDoc creates. We can see the company name,
executive summary, and key recommendations.
We've got a finding summary, complete with the correct color‑coding.
We didn't quite manage to get a graph out of there, so we've
got the highlighted placeholder to remind us to do it in
Excel. Looking at the navigation,
we've got exactly the same format as our original report.
Looking at one of the findings,
we've got almost exactly what we had before here too.
We've got placeholders for likelihood, impact, and risk, although
PwnDoc does actually let you add custom fields, so that is a
further modification Kim could make. The images work, although
might need a border around them,
especially if they have a white background. Hyperlinks are a little
more challenging, so we need to update that manually.
Overall, it's done a good job of putting the report
together. Anything it hasn't done,
we could still easily make sure is highlighted so we
don't forget to do it ourselves.
We need a robust way of working with things that change.
The more we can let automation take over like this, the less mistakes we'll see.