search

Syslifters / sysreptor

A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.
https://docs.sysreptor.com
Other
1.51k stars 144 forks source link

[repo addition] add offsec templates to git #154

Closed GrylledCheez closed 9 months ago

GrylledCheez commented 1 year ago

Please add the Offsec report templates directly to the git so we can make changes for the community.

Some examples of changes I want to make

  1. Offsec had a report naming template of XXXX-OS-YYYYY-Exam-Report.pdf where XXXX is the exam name (i.e. OSCP or OSWA), and YYYYY is the OS-ID.
  2. Offsec reports should default to no password
  3. The OSDA finding template has a field for KQL, but it doesn't get used when the report is rendered
  4. The boilerplate before the High-level Summary should be removable/editable.

Note: these observations were from the v1.1 template found on the syslifters website.

MWedl commented 1 year ago

Offsec design templates are already in the git repo (a bit hidden, though): https://github.com/Syslifters/sysreptor/blob/main/docs/docs/assets/offsec-designs.tar.gz

Feel free to add your changes and open a pull request :)

GrylledCheez commented 1 year ago

But if I make a pull request to that, it doesn't show what I changed. Only that the blob is different.

I guess I should have asked for the templates to be uncompressed.

GrylledCheez commented 1 year ago

@MWedl, a couple of questions about me doing a pull request to do this.

  1. if I decompress the templates and makes the changes, should it be 1 commit or 2?
  2. Should I remove the compressed templates, or add something to the build process that compresses them?
MWedl commented 1 year ago

The tar.gz files were never designed to be managed via git. Even when decompressed and JSON-formatted, they are not very diff-able. Many fields contain long multiline strings (e.g. HTML, CSS, markdown fields). Since JSON does not support multiline strings, these strings are not well diff-able and inconvenient to edit manually.

Therefore, I suggest to use a more human readable/writable format in the git repo, such as TOML (YAML would also be possible, but there are some security-pitfalls while parsing). These TOML files should be converted to JSON and compressed to tar.gz.

To answer your questions:

  1. 2 commits would be great
  2. You can keep the compressed files for now and do the compression by manually executing the script. We still have to decide where to put it into the build process :)
MWedl commented 10 months ago

Hi, we implemented packing and unpacking tar.gz archives to/from TOML files (see https://github.com/Syslifters/reptor/pull/144) and integrated it to the build pipeline for our docs. The source TOML files for Offsec designs are now available in the git repo at https://github.com/Syslifters/sysreptor/tree/main/demo_data/offsec-designs

Feel free to add your changes and open a pull request :)