3 ms·
Out of curiosity, what sorts of processing were you doing for burp and penetration test data? I'm in security, and reporting on tests is always something of a p
by tlavoie 5y ago
Out of curiosity, what sorts of processing were you doing for burp and penetration test data? I'm in security, and reporting on tests is always something of a pain point.
- wglb 5y agoSo the burp log analyzed certain statistics about cookies and url segments. Nowadays there might be ways to do that within burp. Could also look for secrets in bodies. The report one combines all elements of a pen test report including descriptive articles (e.g., what are CSRF, clickjacking, secure headers, and the like), one page for each vulnerability. These pages would include severity, impact, CVE links and CWE links, whether the vuln is closed, open, or risk accepted. Included is a tally of vulns by severity. A glossary of terms is also included. At the end is the glossary and index. A table of contents of course is at the beginning. One improvement is a pie chary of vulnerabilities. The lisp program generates LaTeX and references the article document type. Vastly simplified generating the report as the test went along. Document was one unit and no paring was required.
- tlavoie 5y agoVery cool, thanks for the info!
- wglb 5y agoSome of these will end up on github, but it will take a little time.
- tlavoie 5y agoNice. I suspect I'll mostly stick to taking inspiration, rather than code. I am looking for a solution for an eventual replacement for our team's reporting tool, but would be more likely to simply buy something since writing a replacement isn't my expected role. ;)