search

Syslifters / sysreptor

Fully customisable, offensive security reporting solution designed for pentesters, red teamers and other security-related people alike.
https://docs.sysreptor.com
Other
1.38k stars 132 forks source link

Ability to customize `pentesters` object #226

Open danymat opened 6 months ago

danymat commented 6 months ago

Hello,

It's again me. I'm trying to get a hands on a new design, and I need to create a "Team" List, comprising of Name and Internal identifier (such as PENTESTER_0001)

As of right now, we will use a custom list, comprising of objects that have name and internal_id parameters. However, I was thinking on having the ability of customizing the pentesters object with custom string parameters.

Do you think it would be feasible ? Or does this functionality already exist ?

MWedl commented 6 months ago

Hi, currently it is not possible to define internal_id fields for user objects in the pentesters list. I think adding custom properties to user objects is a great idea to enhance customizability which could be useful in many scenarios.

Are internal_ids global per a user (i.e. the same for every project) or are they different for each project?

A big challenge is how to define the schema for custom global user properties (similar to report/findings fields in designs). I think this will get quite complicated to implement, because we would need to handle schema conflicts on export/import on other instances. Therefore I suggest to keep the user properties a simple object of key-value pairs where values are always strings.

danymat commented 6 months ago

Are internal_ids global per a user (i.e. the same for every project) or are they different for each project?

I think we should start simple, aka global for all projects. At the moment, we use the title_before and title_after to circumvent the limitation (as defined https://docs.sysreptor.com/designer/field-types/#user)

Therefore I suggest to keep the user properties a simple object of key-value pairs where values are always strings.

This is a very good idea, and should be enough for usage