factionsecurity / faction Goto Github PK
View Code? Open in Web Editor NEWPen Test Report Generation and Assessment Collaboration
Home Page: https://www.factionsecurity.com/
License: GNU General Public License v2.0
Pen Test Report Generation and Assessment Collaboration
Home Page: https://www.factionsecurity.com/
License: GNU General Public License v2.0
Hi,
When I want to add a user after the ldap settings are set, it pulls the user from the ldap but does not register it. Initially, it states that it cannot find the file named db.config in the /opt/faction/ directory. When I create that file manually in Docker, it does not give the error that it cannot find the file, but I cannot add a user either.
It appears that faction is using MongoDB 5.0+ which requires a CPU with AVX support. I was able to get everything setup not having this support, but after running the docker container you will not be able to get any further as Tomcat will just show a 404 page and you will not be able to reach the webUI. 'MongoDB 5.0+ which requires a CPU with AVX support' should be added as a requirement in the README. Edit: Some hypervisors such as Oracle don't pass the flag, so this issue is probably more prevalent for people who use VMs.
-Mav
might want to add to your documentation that it requires maven to be installed for the mvn command
I have been playing around with a lot of different reporting tools as of late trying to find the best fit. I really enjoy the feel of faction but have the following issues. As the title states there is a mix of requests/questions!
If an assessment is finalized early, the assigned consultants are not set to free. This is an issue as for bigger consultancies, you may have 3 specialists on the project for a few days of the overall scope just to complete their section but then they cannot be assigned to another project.
Highlight color doesn't work for notes when scheduling (it does for all other places referenced as far as I could discover)
Scheduling:
Expected:
Custom fields only reflect on newly scheduled projects and newly created vulnerabilities inside new projects. IE if I have a vulnerability template and a month later add 4 custom fields, I have to create a new template manually to add the new fields or likewise with an existing project, a client may request for x field adding but that would require deleting the scheduled assessment, creating a new one and importing all data manually to support it. The latter is an edge case, but the issue is still present.
Custom fields support very limited types, consisting of string, bool and list. It would be great to get support for more complex data types. A big example would be supporting the large text boxes / markdown boxes that are contained through the reports. Past this 'object' support would be great. An example of where this could be used is in the likes of version control. Sysreptor offers this feature and it allows you to create for example a list of objects consisting of version number, consultant name, comment. That way with each new version you add an item to the list that generates the rest of the fields you require.
I think an amazing start would be to support the large text fields, but the object support would be super nice to have.
Adding graphs into the report dynamically based on templates would be awesome. Specifically would be looking to great graphs based on the issues/vulnerabilities raised, such as number of vulnerabilities broken down by severity:
There's a logic decisions that are neither bugs or features but maybe just something to raise to see peoples thoughts / if toggled support for them could be added to the config perhaps.
We have cases where budgets clash and a client may not be able to schedule a retest assessment so we would consider the project complete. However, a few months later they will request a retest. Now we can use the docx we got from the initial reporting and manually update it but it would be great to be able to have a way to reopen a finalized assessment as opposed to creating a new assessment.
Some clients in parts of the worlds have set requirements on data retention, this is a big EU issue. As it stands, not being able to delete a finalized report poses some problems as clients that fall out of that retention window would need to either be manually deleted from the DB or we would have to flush the data out entirely which isn't feasible with ongoing assessments.
This somewhat relates to the thoughts behind my bug fix request 'Finalized assessment locks consultants'. You are unable to assign a consultant to more than one project. I understand why the logic would dictate not doing this but in some cases its required. It would be good to be able to overlap these possibly with a warning message 'this consultant is assigned to x project on this date, are you sure...'.
Please note all these points where gathered over the weekend so I may have missed/overlooked stuff mentioned. If thats the case please direct me :).
I hope this is the right place to ask and, if by any chance, you recognise I have missed something and/or this is not the right place to ask feel free to delete this message.
I was trying to add vulnerabilities the available documentation at https://docs.factionsecurity.com/Importing%20Your%20Vulnerability%20Templates%20Via%20the%20API/ by using JSON with the following payload:
curl -X 'POST'
'http://localhost:8080/api/vulnerabilities/default'
-H 'accept: application/json'
-H 'FACTION-API-KEY: API_KEY'
-H 'Content-Type: application/json'
-d '[
{
"Name": "This_is_a_test",
"CategoryName": "Unvalidated Input",
"Description": "Description",
"Recommendation": "Recommendation",
"LikelihoodId": 4,
"ImpactId": 4,
"SeverityId": 4,
"Active": true
}
]'
This request will result in the creation of the vulnerability but, as you can see from the screenshot, it will not include any of the details provided. Did I miss something?
I also tried changing the name of the parameters (in the web UI for example the Likelihood parameters is "Likelyhood") but it did not yield any successful results.
Also, there seems to be something weird happening since the Impact and Likelihood are correct while the overall Severity is not. In addition, no information regarding the issue description or recommendation is added.
I have recently redeployed a faction server and I can't seem to download my reports.
I've tried to download sample reports and custom reports, default template and custom template - all to no avail.
The image below demonstrates that my report is showing as successfully generated, however when i click download - it opens a new tab and does not download anything.
Screenshot also shows version number
To confirm that it wasn't a simple case of 'PEBKAC', I've redeployed on both 2 separate VPS's and locally in VM's - the issue replicates every time.
Hi
Im unable to deploy the war file directly on tomcat server as it i throwing the error Application at path /faction could not be started ANy suggestions would be greatly appreciated
Hello. I encountered an error while trying to configure SMTP settings. Inputs include SMTP server, port, password and so on. When you type and save, a few TAB spaces are added before and after the text written to the input. I think this is why I couldn't get SMTP and e-mails to work. Does anyone know the solution to this problem?
Edit :
Also i can not select checklist from Checlists tab in Assesment page of project. I created checklists, but the dropdown does not appear in the list.
Also i can not generate report. When i click to generate report button under finalize tab loader waiting for 3-4 second and not showing any error or any information about it.
Originally posted by @codessensei in #31
Hi,
I am testing Version 1.1.25.2, self hosted.
I am trying to configure a report in a way that each vulnerability has its how heading, so far i was able to make it work using the following:
${fiBegin}
1.1 ${vulnname}
Table with vulnerability details using ${severity}, ${category}, ${desc}, etc...
${fiEnd}
It creates the vulnerabilities following the heading (1.1, 1.2, 1.3, etc... ) but i am not able to set the severity colors.
if i add "${vulnTable} ${cells Critical=8064a2,High=c0504d,Medium=e68e00, Low=33D7FF,Recommended=081417,Informational=657376}"" to the top row of my table it does not interpret it.
${fiBegin} and ${vulnTable} ${cells} are not compatible?
Is there a way to define severity color for a specific cell in conjunction with ${fiBegin} / ${fiEnd} ?
Thank you.
I successfully build the image from github but during deployment image to container it;s failing on errors bellow:
[ERROR] 2024-08-06 13:06:45.585 [main] DefaultClassFinder - Unable to read class [com.fuse.actions.appstore.InstallExtensionController] java.lang.IllegalArgumentException: null at org.objectweb.asm.ClassReader.<init>(Unknown Source) ~[asm-5.1.jar:5.1] at org.objectweb.asm.ClassReader.<init>(Unknown Source) ~[asm-5.1.jar:5.1] at org.objectweb.asm.ClassReader.<init>(Unknown Source) ~[asm-5.1.jar:5.1] at org.apache.struts2.convention.DefaultClassFinder.readClassDef(DefaultClassFinder.java:458) ~[struts2-convention-plugin-2.5.12.jar:2.5.12] at org.apache.struts2.convention.DefaultClassFinder.access$200(DefaultClassFinder.java:49) ~[struts2-convention-plugin-2.5.12.jar:2.5.12] at org.apache.struts2.convention.DefaultClassFinder$InfoBuildingVisitor.extractSuperInterfaces(DefaultClassFinder.java:511) ~[struts2-convention-plugin-2.5.12.jar:2.5.12] at org.apache.struts2.convention.DefaultClassFinder$InfoBuildingVisitor.visit(DefaultClassFinder.java:498) ~[struts2-convention-plugin-2.5.12.jar:2.5.12]
Could it possible to add
mvn clean compile war:war
git clone [email protected]:factionsecurity/faction.git
cd faction
mvn clean compile war:war
docker-compose up --build
Thanks
is there any plan to include editors in custom field section?
Hey thanks for the report generator. I built the latest image and when you type in any of the text boxes, the autosave seems to kick in and the cursor automatically jumps to the beginning of the line whilst typing. Tried on multiple builds, Chrome, Firefox and all the same behavior.
I had a further look and it appears it might be related to SunEditor
Hello,
I don't see how to get access to the app store.
Admin -> App Store links to http://myip:8080/portal/Upgrade
Lands me at the hosted platform.
The upgrade page just leads to a contact form.
The docs (https://docs.factionsecurity.com/Faction%20App%20Store%20Extensions/) and the example projects say you can upload the jar file to the app store. https://github.com/factionsecurity/Faction-Vulnerability-Bar-Chart
https://docs.factionsecurity.com/APIS/App%20Store%20Extension%20API/
The github or other sponsorship options don't reference a paid version.
I was just wanting to add the bar charts...
Hi, thanks for building Faction! I've been trying it out and tried to get a modified template in, but can't get it past:
faction/src/com/fuse/docx/DocxUtils.java
Line 1131 in 4267f94
Generation completes with an error, after which the download fails. Here is the log:
com.openhtmltopdf.match INFO:: Matcher created with 175 selectors
java.lang.IllegalStateException: could not located the paragraph in the specified list!
at com.google.common.base.Preconditions.checkState(Preconditions.java:508)
at com.fuse.docx.DocxUtils.updateDocWithExtensions(DocxUtils.java:1131)
at com.fuse.docx.DocxUtils.generateDocx(DocxUtils.java:379)
at com.fuse.utils.GenerateReport.generateDocxReport(GenerateReport.java:204)
at com.fuse.tasks.ReportGenThread.run(ReportGenThread.java:72)
at com.fuse.tasks.TaskQueueExecutor$1.run(TaskQueueExecutor.java:25)
at java.base/java.lang.Thread.run(Unknown Source)
Finished Generating Report
Update Notifications
Notifications Sent
java.lang.NullPointerException
at com.fuse.servlets.getReport.doGet(getReport.java:134)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:529)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:623)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:199)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
at org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter.doFilter(StrutsPrepareAndExecuteFilter.java:125)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:168)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:144)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:168)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:481)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:660)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:346)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:388)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:936)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1791)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
at java.base/java.lang.Thread.run(Unknown Source)
Ignoring the presence of textboxes would work for my use case. I don't have any templating placeholders in the textbox.
Reproduction is faily easy, put a textbox with the text "Just a text box" in the default-report-template.docx document and upload it via Templates > Report Designer > Edit Sample Template. Then generate a new report and (attempt to) download it.
Running Faction 1.2.6
I changed the error to:
Preconditions.checkState(index > -1, "could not located the paragraph " + paragraph + " in the specified list! at " + index);
and got:
java.lang.IllegalStateException: could not located the paragraph Just a text box in the specified list! at -1
I'm not sure what would be the proper fix in the code.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.