SimplE RePort wrIting and COllaboration tool
Clone or download
BuffaloWill Merge pull request #517 from MaxNad/plugin_refactor
Made plugins aware of report generation and deletion
Latest commit eb4cd75 Jan 7, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github modified issue template Sep 28, 2016
attachments should have blank attachments directory Jul 30, 2013
db need blank db dir May 23, 2014
docker feat(docker): Added basic development image for docker. Oct 5, 2018
docs feat(docker): Added basic development image for docker. Oct 5, 2018
helpers Merge pull request #517 from MaxNad/plugin_refactor Jan 8, 2019
log fixed logging in osx, supportrt for #162 Sep 5, 2016
model feat: Add finding state tracking to facilitate QA Oct 6, 2018
public added missing lib for template debug feature May 18, 2018
routes Merge pull request #517 from MaxNad/plugin_refactor Jan 8, 2019
scripts feat: Add finding state tracking to facilitate QA Oct 6, 2018
templates Replaced <<CUSTOMER>> with <<full_company_name>> in the predefined is… Oct 3, 2018
test implenting good practices Mar 2, 2018
tmp need blank tmp directory Jul 26, 2013
views Merge pull request #514 from alxbl/finding-state Nov 23, 2018
.gitignore Merge pull request #514 from alxbl/finding-state Nov 23, 2018
.ruby-version Add .ruby-version Oct 19, 2018
Dockerfile Updating DockerFile Nov 28, 2018
Gemfile fix: Revert Ruby version to 2.3.3 Nov 23, 2018
Gemfile.lock bump for Gemfile to support burp 2.0 xml imports Oct 26, 2018
LICENSE.TXT updated license Jan 2, 2017
README.md readme update Jul 27, 2018
VERSION.txt Updated Version Jun 2, 2018
config.json changed back to original config.json Oct 26, 2016
config.json.defaults Merge branch 'master' into findings_type_config Jan 8, 2019
docker-compose.yml feat(docker): Added basic development image for docker. Oct 5, 2018
serpico.rb Merge branch 'master' into ruby_good_practices Apr 25, 2018
server.rb Merge branch 'master' into findings_type_config Jan 8, 2019

README.md

Serpico

SimplE RePort wrIting and CollaboratiOn tool

Serpico is a penetration testing report generation and collaboration tool. It was developed to cut down on the amount of time it takes to write a penetration testing report.

Serpico Demo Video

Additional Video Demos

Installation

The installation options are:

Post-Installation Releases : Getting Started

Kali/Ubuntu/Debian

Initialize the database:

/opt/Serpico/init_serpico.sh

And then start Serpico:

/opt/Serpico/start_serpico.sh

OS X

Initialize the database:

/Users/Shared/Serpico/init_serpico.sh

Start Serpico:

/Users/Shared/Serpico/start_serpico.sh

Windows

Initialize the database:

C:\Serpico\init_serpico.bat

Start Serpico:

C:\Serpico\start_serpico.bat

About Serpico

Serpico is at its core a report generation tool but targeted at creating information security reports. When building a report the user adds "findings" from the template database to the report. When there are enough findings, click 'Generate Report' to create the docx with your findings. The docx design comes from a Report Template which can be added through the UI; a default one is included. The Report Templates use a custom Markup Language to stub the data from the UI (i.e. findings, customer name, etc) and put them into the report.

Features

Report Template Editing is Easy

Philosophy: Editing a report template should be easy. During peer review we would constantly ran into "little things" we were fixing from the report template; an extra space here, a misspelling there. But it adds up. With Serpico, "fix" the report template, upload it back through the UI, and generate a new report; the error should be fixed permanently.

Template Database

Philosophy: We do not need to write most findings from scratch. Most findings have been found in a previous assessment. In Serpico, all authors can pull findings from the template database and add to the report. A user can also 'Upload' a finding they made into the Template Database to share with everyone.

Attachment Collaboration

Philosophy: It should be easy to share files with teammates. Use the 'Add Attachment' functionality to store a file (e.g. screenshots, nmap scans) or share with teammates on a pen test. No thumb drive swapping or e-mailing, just log into the UI and download the files. At the end of the assessment everything traded or generated for that assessment is in one place.

Microsoft Word Meta-Language

The Meta language used for Microsoft Word was designed to be as simple as possible while still serving enough features to create a basic penetration test report. That being said it has a learning curve (and many bugs) and I highly suggest looking at "Serpico - Report.docx" or "Serpico - No DREAD.docx" and editing these rather than working from scratch.

See also:

Support

  • Wiki: We try to add most common questions to the wiki.
  • Slack
  • Issue : If you have found a bug or would like a new feature
  • E-mail Support: For teams of users or template related questions

GOTCHAS

  • Microsoft has a really annoying habit of changing a character for you. Always beware of this when working with the meta language