Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
This branch is 21 commits ahead, 400 commits behind SerpicoProject:master.

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


SimplE RePort wrIting and CollaboratiOn tool NEXT-GENERATION

Serpico was a cool open-source penetration testing report generation and collaboration tool. It was developed to cut down on the amount of time it takes to write a penetration testing report, and now it's even better!

Docker Installation

The installation commands for installing on a Ubuntu 16.04.2 LTS container:

mkdir Serpico-NG && cd Serpico-NG
curl | docker build -f - .

Manual Installation

The installation commands for an Ubuntu 16.04.2 LTS are:

Install required packages:

sudo apt-get install git ruby ruby-dev build-essential make pkg-config libxml2-dev libglib2.0-dev libsqlite3-dev bundler

Clone git repository:

git clone

Install Serpico-NG dependencies:

cd Serpico-NG && bundler install

Clone repository of dm-types library:

cd .. && git clone -b "gem-v1.2.2-with-frozen-nilclass-fix"

Install dm-types library:

cd dm-types && gem build dm-types.gemspec && sudo gem install dm-types-1.2.2.gem

Post-Installation Releases : Getting Started

Ubuntu 16.04.2 LTS

Launch the first_time.rb script (in order to initialize the database) and follow the instructions:

cd Serpico-NG && ruby scripts/first_time.rb

And then start Serpico-NG (HTTPS, 8443 port, on by default):

cd Serpico-NG && ruby serpico.rb &

About Serpico

Serpico is at its core a report generation tool but targeted at creating information security reports. When building a report the user adds "findings" from the template database to the report. When there are enough findings, click 'Generate Report' to create the docx with your findings. The docx design comes from a Report Template which can be added through the UI; a default one is included. The Report Templates use a custom Markup Language to stub the data from the UI (i.e. findings, customer name, etc) and put them into the report.

NEW Features

Import XML report from Nexpose

Nexpose parser added. Now you can import findings directly from Nexpose XML report and have your doc report done in seconds. Import from Nexpose

New Statistics & Charts

Philosophy: Having things under control. Statistics and beatiful charts (Thanks Chart.js) were added. Calendar

New risk scoring system w/ auto CVSS Calculator

Philosophy: Calculating risk of findings should be easy. Now the analyst is able to calc the CVSS (v2) score directly from the finding view, keeping the focus on it. CVSS

Generate Remediation Plan in XLSX

XLSX Remediation Plan Generate the remediation plan in just one click.


Philosophy: Scheduling. Now you can place your tasks over time and see the history on a nice calendar view Calendar

Backup & Restore

Now you can backup database (including attachments) and restore in matter of seconds! (See Wiki)

Auto Summarize of findings overview thanks to NLP

Philosophy: Automation. A Natural Language Processing library was added, it summarize the description of findings for you, saving precious time.

Legacy Features

Report Template Editing is Easy

Philosophy: Editing a report template should be easy. During peer review we would constantly ran into "little things" we were fixing from the report template; an extra space here, a misspelling there. But it adds up. With Serpico, "fix" the report template, upload it back through the UI, and generate a new report; the error should be fixed permanently.

Template Database

Philosophy: We do not need to write most findings from scratch. Most findings have been found in a previous assessment. In Serpico, all authors can pull findings from the template database and add to the report. A user can also 'Upload' a finding they made into the Template Database to share with everyone.

Attachment Collaboration

Philosophy: It should be easy to share files with teammates. Use the 'Add Attachment' functionality to store a file (e.g. screenshots, nmap scans) or share with teammates on a pen test. No thumb drive swapping or e-mailing, just log into the UI and download the files. At the end of the assessment everything traded or generated for that assessment is in one place.

Microsoft Word Meta-Language

The Meta language used for Microsoft Word was designed to be as simple as possible while still serving enough features to create a basic penetration test report.

See also:


  • Wiki: We try to add most common questions to the wiki.
  • Issue : If you have found a bug or would like a new feature









No packages published


  • JavaScript 55.7%
  • Ruby 23.2%
  • HTML 13.4%
  • CSS 7.6%
  • Shell 0.1%