Author Archives: Tabatha DiDomenico

On being human.

Our team has grown slowly and deliberately from a single person at the start to a nine-person team in 2021. Some things that work well enough on a small team need more thought as the group expands. With that in mind, we are encouraged and continuously reminded from the day we are hired to challenge our status quo and enabled to suggest and adopt changes.

Embracing that opportunity means our internal processes and approaches evolve as each new person joins the team and adds unique perspectives. As a global team, our views are as varied and diverse as the individuals providing them.

We have internal core values and guidelines for working together as a fully remote and distributed team that might be worth sharing in future posts. We have a clear mission, which I’ll share here to save you a few clicks. 

We help information security teams focus on making systems more secure by reducing the overhead of managing and discussing the outcome of the security assessments they perform for their clients (whether these are inside their organisation or outside of it).

Not too long ago, we realized that there is a bunch of info about Dradis out there – how it works, what it does and doesn’t do, how to use it, etc. Still, not much is available to help the community understand the people and company behind the tool. Taking inspiration from companies like Balsamiq, we decided to do something about that gap. Now, we’ve put into words what we believe to share with you and the ideas that give us a yardstick to measure our decisions against. Without further ado:

We are here for the humans. At the end of the day, the work done in infosec is for and about humans. And as messy as humans are, that can make this work frustratingly complicated. Sure, scanning tools and blinking boxes can handle some of it – but pulling everything together requires a human. We are here to make it simpler for you to be human by getting the time sucks out of your way.

Infosec is a team sport. Just like information systems are interconnected, so are the different folks involved in securing them. Sharing clear information and thinking creatively together is often critical to solving the problem at hand, so let’s do more of that well.

Customers + Vision = Roadmap. We don’t have an official roadmap, but that’s not to say we don’t have plans. We’ve got big ideas on how this industry will continue to evolve and how we can best serve you and your customers. That’s why we reach out to our customers and invite your feedback.

It’s your data. You keep it. Whatever data you put in Dradis, is yours, and we like it that way. We respect your privacy and that of your customers like we value our own. We trust that you will let us know how we can improve and make a better product.

These declarations of what we believe are posted on our website so you can revisit them, and new users can easily find them. These beliefs may change as we grow as a team and new voices are added, and as this industry faces new challenges. I hope you’ll help us stay accountable to these beliefs and call us out if you see us not operating consistently to them.

We are human, after all.

The humans behind Dradis

New in Dradis Pro v4.0

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Gateway Themes

One of the biggest changes in Dradis Pro v.4.0 is the move from a single HTML Gateway template to Liquid themes. Create a dynamic, info packed, theme to deliver assessment results dynamically in Gateway using Liquid. Multiple Gateway themes means each project can use a different theme that’s appropriate to the engagement. Two new Gateway themes are included with Dradis Pro v4.0 to get you started.

Liquid has a well supported and documented history for creating robust templates. This will make it easier for teams to create and support their own well organized, customized templates.

Are you currently using a customized Gateway HTML template? Reach out to our team with your existing template so we can help convert it to Liquid before you upgrade any production instances.

Downloadable Assets

In addition to reviewing the results of an assessment dynamically in Gateway, contributing users can securely download assets that have been added to their project. Deliver final reports, scope documents, and other assets directly from Gateway keeping everyone out of their inboxes and project details centralized.

Simple Team Setup

Getting started using Dradis Pro is simple. Once deployed to your environment, the super-admin for the instance is created during the first run and can quickly set up the rest of the team through this new guided walk-through.

Maximum Login Attempts

Configure the number of maximum login attempts to help prevent brute-force attacks on your Dradis instance. The default is set to 3 attempts before the account is locked. Admins can increase or decrease the number of attempts to align with their team’s policies.

Captain Kirk and Sulu are both locked out for entering invalid credentials

Release Notes

  • Projects:
    • Cleanup the New/Edit view
    • Create and remove the results portal from the Edit view
    • Dashboard: Add Default issue entry to menu when project is empty
    • If there is only one RTP, select it by default
  • Setup: new initial Team and User wizard
  • Teams: cleanup the New/Edit view
  • Users: account gets locked after too many failed sign in attempts
  • Upgraded gems: addressable, nokogiri, papertrail, puma
  • Bugs fixed:
    • Better support for characters inside textile linked text
    • Display placeholder text for issue sorting dropdown when no field has been selected to remove confusion about default options that are not yet applied
    • Fix issue library entries action buttons not appearing due to caching
    • Fix revisions with “destroy” event not removed from the database after deleting a project
  • Integration enhancements:
    • Acunetix:
      • Add support for Acunetix 360
      • Make Request and Response fields available at the Evidence level
    • Gateway 🍾
      • Moved project contributor assignment to Gateway management
      • Deliverable upload management
        • Your contributors can now download assets directly from your results portal!
      • Themes!
        • Gateway now supports theme management and the ability to apply different themes to different projects
    • IssueLib entries#index API now supports pagination
    • Nessus:
      • Add age_of_vuln, exploit_code_maturity, threat_intensity_last_28 threat_recency, and threat_sources_last_28 as available Issue fields
    • Nexpose:
      • Update HTML tag cleanup
    • Nipper:
      • Include multiple paragraphs when importing fields.
    • Remediation Tracker
      • Use Datatables for the Tickets#index table
  • Reporting enhancements:
    • Word:
      • Add support for template syntax within resources exported in Word reports
      • Fix exporting node labels with links
  • REST/JSON API enhancements:
    • Update the API to handle pagination
  • Security Fixes:
    • Medium: Authenticated (contributor) information disclosure
      • After a contributor was assigned Gateway access to a project by an admin user they may retain access to the project after the projects team has been changed.

Not using Dradis Pro?

New in Dradis Pro v3.12

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Instance Notifications

All notifications now display at the instance level so you don’t have to open each project to see notifications. These Dradis instance-wide notifications include notifications from updates in Remediation Tracker tickets too.

Accessibility Improvements

Dradis font and element contrast are adjusted to meet Level AA WCAG 2.0 standards. Also, screen reader and alt-text are added and a few broken Aria references and missing labels are fixed. All of these improvements make Dradis easier for everyone to use.

Emojis 🥳

We 💖 love emojis on the Security Roots team and use them all the time working together. 😤 It was frustrating that we couldn’t use them in Dradis, so we added them 🎉! Now you can use emojis in any input field of Dradis to express yourself or within projects details for additional context. 😎

ServiceNow Integration

Create a ServiceNow Vulnerable Item from a Dradis Issue in a few clicks. The new ServiceNow integration allows the owner of the system to receive critical finding details so they can handle remediation outside of Dradis.

Release Notes

  • Add avatar and user’s name to project navbar
  • Comments:
    • Load feed asynchronously
  • Configuration Kits
  • Emojis! Update the database collation to allow emojis
  • Improve accessibility:
    • Add alt text to any linked images
    • Add screen reader only text to forms
    • Adjustments to font and element contrast to meet at minimum Level AA WCAG 2.0 standards
    • Fix any broken Aria references
    • Update element label association & add missing labels
  • Mintcreek notifications:
    • Add notifications dropdown in mintcreek navbar
    • Add project and plugin notifications in the view
    • Authors and contributors will now be notified when assigned a project
  • Replace deprecated font-awesome-sass gem with vendor asset files
  • Rule Engine: include rule name in upload console
  • Subscriptions:
    • Load feed asynchronously
  • Truncate long hostnames when viewing evidence in an issue
  • Upgraded gems:
    • Rails
  • Bugs fixed:
    • Fix attachments base64 encoding for filenames with symbols
    • Placeholder gravatars appear if gravatar is not available
    • SMTP file will take configuration precedence again
    • Update the HelpScout beacon in the instance admin
  • Integration enhancements:
    • Remediation Tracker:
      • Add activity and comment feed
      • Users can now be subscribed to tickets
  • Reporting enhancements:
    • Fix exporting formatting in content controls without Crazy Triangles
    • Fix exporting captions with non-alpha characters
    • Fix URLs breaking textile table formatting

Not using Dradis Pro on your team?

New in Dradis Pro v3.11

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

JIRA Sync

Details added to JIRA tickets will now sync back to Dradis Issues and Remediation Tracker tickets making it easier to keep all of the project details together to speed up remediation tasks.

Ruby 2.7.2 and Rails 6.1.1

Sometimes we have to roll up our sleeves and take care of the less flashy bits of development. In this version, it was due time to update Ruby, Rails, and a handful of other gems. There won’t be a noticeable difference on your side but this sets up the team to make future improvements.

Improved Caching

When the projects listing or Issue Library contained thousands of entries, it became slow to load and in some cases wouldn’t load at all. This update improves caching to make it much faster to load those long lists.

Release Notes

  • Upgraded DradisPro to run on Ruby 2.7.2 and Rails 6.1.1
  • Add view hooks for the export view
  • Increase secondary sidebar width for medium viewports
  • Projects page: Add caching to speed up slow loading when thousands of projects are present
  • Upgraded gems: bundler, papertrail, rails
  • Bugs fixed:
    • Correct position of sticky editor toolbar in fullscreen source view
  • Integration enhancements:
    • Integrate JIRA ticket/status details into Remediation Tracker
    • IssueLib: Add caching to speed up the issuelib table when thousands of entries are present
    • Add remote JIRA Comments to Issues#show and Tickets#show
  • Security Fixes:
    • Medium: Authenticated (admin) persistent cross-site scripting in Business Intelligence Custom Properties search

Not using Dradis Pro on your team?

New in Dradis Pro v3.10

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

User on, User off

Users can be toggled between disabled and re-enabled. Disabled users cannot access the app, aren’t available to mention in comments, and will not receive notifications. Content from disabled users won’t be deleted and they will need to be re-enabled before modifying any permissions.

Bye for now, Bones

Word Report Export Tune-Up

Bunches of things happen under the hood in Dradis when you are kicked back waiting for the magic to happen to generate a Word report. Some of those inner workings got a tune-up to get Dradis in a better position for future improvements in this version. Imagine how excited we were when we saw some small performance gains as a byproduct of this refactor!

Fancy Output Logs

Export log files are not only fancier looking, but the updated formatting makes them much easier to review. Indents indicate nested items and coloured lines of text are a snap to scan to keep an eye out for any problems and when items finish successfully.

So Fancy!

Change Project Owner

“Change is inevitable” and now, you can change project owners in Dradis. Project owners can be updated in both the web app on the “People on the Project” and through a new API endpoint.

Spock is the project’s new owner

Release Notes

  • Disabled users enhancement
    • Allow admins to disable and re-enable users and contributors
    • Removed disabled users from comment mentions list
    • Stop disabled users from receiving notifications
  • Main sidebar improvements:
    • Labels added under icons
    • Removed animations and transitions while expanding and collapsing
  • Migrate bootstrap to v4
  • Navbar dropdown menu’s are no longer locked to the right side of the browser
  • New item menu in sidebar: isolate Default entry (from template) with a divider
  • Update logo assets
  • Project owners can now be updated
  • Bugs fixed:
    • Christmas easter egg Santa hat blocking clicks on input element plugins
    • Rules Engine: make sure tag auto-complete works on page render
  • New integrations:
    • dradis-nipper
  • Integration enhancements:
    • Allow viewable image attachments for Gateway contributors
    • IssueLib: ability to seed with the starter set
  • Reporting enhancements:
    • Performance:
      • Re-work Word export processing top to bottom
      • Faster hyperlink processing
      • Faster numbering processing
      • Faster screenshot processing
    • Remove unused nested content controls from all resource types (issues, content blocks, evidence etc.)
    • Introducing the new and improved servicesEntries and ServicesTable content controls with full support for filtering and sorting
      • When nested inside a Node control you can get direct access to Services attributes with a servicesEntries control, and child attribute controls eg. Protocol, State, Port, etc.
      • The existing services control that produces pre-formatted table-based data can now be labeled ServicesTable in your template
    • Enhance report export log in both the CLI, and Web Console
      • Indented log lines to enhance readability and make it simple to follow nested processing. ex. Evidence within a Node.
      • Colors! Make use of colours to show
        • Green: when processing is successful
        • Yellow: when filters filter out all resources
        • Red: when something bad happens like a control has no placeholder
  • REST/JSON API enhancements:
    • Add new endpoint to update project owner

Hands on Hacking

The team over at Hacker House has recently released their first book, Hands on Hacking. The book is an incredibly accessible guide for learning pentesting and purple teaming and includes often-overlooked subjects like building a business case for hacking, ethical guidelines, and report writing. 

Report writing, you say?

Needless to say, when authors Matthew Hickey and Jennifer Arcuri reached out to let us know they were featuring Dradis in the chapter on reporting, we were delighted. Since the book’s release, I’ve been able to chat with Matthew to ask about writing this book, his start in hacking and growing a career in the industry, and his favorite reads. 

You can read the full interview with Matthew Hickey at the Dradis Academy.

Hands on Hacking takes a holistic approach to hacking appropriate for those just getting started as well as for management and sysadmins wanting a deeper understanding of the attacks their organization and systems face. 

Want to win a copy of Hands on Hacking?

The team over at Wiley sent us a few copies to giveaway. To enter, share your email address with us below. Winners will be selected at random on October 9, 2020 and contacted at the email address provided to collect shipping information.

The contest is now over, thanks for entering!

New in Dradis Pro v3.9

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

MS Word Filters – OR, NOT

Filtering content using OR and NOT hasn’t been possible until now! Now you can add OR and NOT operators to create a dizzying amount of control for your report output. As always, you can string together multiple filters to get the results you want to populate your report.

Imagine That!

We’ve added the ability to upload an image anywhere the editing toolbar appears. Dragging and dropping into the editing area works too, saving you a few steps to add images in your project to show evidence, support your statement, or even add a meme to your comment.

Even More Validation

Meme of cartoon shouting validate all the things

Validating your project before generating it has long been available as a good step to preventing some of the most common report errors. Now, view additional validation in summary views and a panel to help avoid those errors as you are working with report content to catch problems early.

For an at-a-glance way to see what needs a bit more work, the issues and evidence tables include a column showing if that item contains the correct information.

Looks like something needs to be modified…

Issues, evidence, and content blocks now have a validation panel that will highlight problems as you work.

That missing vector could cause problems, glad we caught it now!

Release Notes

  • Add a validation panel for Issues, Evidence, and Content Blocks
  • Add a validation column for Issues and Evidence table
  • Auto upload attachments and screenshots without requiring the use of the staging area
  • Cards, Evidence, Issues, and Notes now have their own attachment support
  • Displays a notification badge in the browser tab when there are unread notifications
  • Editor: Allow drag & drop, copy & paste, and direct image uploading
  • Increase the node properties column size by changing it to LONGTEXT
  • Layout: Breadcrumbs have a fixed position
  • Upload Manager: better validation
  • Bugs fixed:
    • Live filtering of templates (methodologies, notes & projects) via sidebar
    • Use absolute send times in notification emails instead of relative
  • Reporting enhancements:
    • Excel: Fix report generation exceeding the maximum cell limit
    • Word: Add NOT and OR operation for filtering content control
    • Word: Allow non-English localization documents to be exported

New in Dradis Pro v3.7

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Formatting Toolbar

Formatting text is even easier now with the editor toolbar. The toolbar makes it simple to enter and format text in an issue, evidence, notes, comments, and methodologies without needing to use Textile markup. The live preview updates with your formatting changes as you work.

Form Editor

Manually create issues and evidence using the form view, rather than using Textile field names and details. Name the form field and add in details for each item and the live preview updates as you work on the side.

If your project has a predefined template, using that template will create those form fields ready to populate.

Prefer to work with Textile? The source view is still available so you have the best of both worlds.

Dots Menu

In order to make the most of the available screen space, some item options – including edit, delete, and subscribe – have been moved to a single “dots” menu. The dots menu is located to the top right of the item and includes the actions available for that item.

Methodology Improvements

Cards in methodologies no longer require a due date. This is helpful for cards that are templates or hold information that doesn’t need to be locked to a specific date.

If a card has moved from one list to another, the original card link will redirect you to the card at its current location. Previously the link to the card would be broken, leaving you to hunt around until you found it (or didn’t and gave up looking).

Making it easier to find the board you are looking for, you can click on a methodology in the project dashboard or the board name in the activity feed to go to that board.

Release Notes

  • Add author to evidence and notes views
  • Add dynamic columns, sorting and filtering to Projects list
  • Add team name link to project navbar
  • Adjust Uploads layout to provide more visibility to the output console
  • Allow renaming and deleting boards through their dots menu
  • Avoid browser pre-populating password fields when editing users
  • Card improvements:
    • Not require a mandatory due date
    • Redirect to new url if the card has changed lists
    • Show board name and link in the Activity Feed
  • Card, Evidence, Issue, and Note form data will not be lost even if the form is not saved
    • Clear the form when the “Cancel” link is clicked
    • Remove prompt to restore data and instead persist and restore any changes seamlessly
  • Comments
    • Add Textile markup
    • Not lose changes even if the comment is not saved
    • Update comments feed to show author’s name instead of email
  • Display note and evidence titles in breadcrumbs
  • Display the Dots-menu in all views
  • Editor improvements:
    • Formatting toolbar to help with markup
    • New form-view to edit each field individually
    • Side-by-side editor preview that auto-updates
  • Generate consistent URLs in emails
  • Increase the size of output console
  • Let Admins be added or removed after a project is created
  • Link to Methodology from project summary chart
  • Move resource action links to dots-menu in breadcrumbs
  • Persist the state of the navigation sidebar in projects while navigating across different views
  • Remove tag color from issue titles in issue summary
  • Update code element style
  • Use shared noscript partial
  • Use user model reference for activities instead of user email
  • Upgraded gems: puma, rack, rails, sass-rails
  • Bugs fixed:
    • Allow Authors to set project permissions on project creation again
    • Fix Board partial broken structure
    • Fix ItemsTable extra whitespace causing unnecessary vertical scrolling
    • Fix Long items_table dropdown menus not scrollable
    • Fix Long project names interfering with search bar expansion
    • Fix breadcrumbs in cards under node boards
    • Fix textile preview not showing on issues with very long text
    • Prevent repetitive prompt when images are pasted after navigating multiple views.
    • Prevent report ‘Download’ button becoming a disabled ‘Processing…’ button once clicked
    • Render Textile preview of issues with very long text
    • Render avatars in the activity feed
    • Set :author when creating Evidence from an Issue
    • Show active state of Sidebar items properly
    • Bug tracker items: #560, #634
  • Integration enhancements:
    • Issue Library: sortable columns
    • Nexpose: better cipher wrapping coverage
    • Nikto: support new nested format
  • Reporting enhancements:
    • Custom Properties are now updated on document open
    • HTML reports now use main app’s markup rendering
  • Security Fixes:
    • Medium: Authenticated persistent comments cross-site scripting
    • Low: Authenticated (admin) persistent methodology template cross-site scripting

Not using Dradis Pro on your team?

New in Dradis Pro v3.6

Dradis Framework is a collaboration and reporting tool for information security teams to manage and deliver the results of security assessments, in less time and with less frustration than manual methods.

Hello, good looking.

screen showing the project summary in Dradis Tylium theme
Tylium is included with Dradis Pro v3.6 and CE 3.16

We’ve introduced a new project theme for Dradis. Tylium* is more than sprucing up the design with sleek lines and modern styles. It incorporates thoughtful details to improve your workflow and provides us greater flexibility to address your UI feedback moving forward.

This is a big visual change, but you won’t have to hunt for the Dradis items you rely on since they haven’t gone too far from the previous theme, Snowcrash. We’ve minimized the impact on your day-to-day use of Dradis by keeping the feel and flow of the app familiar. 

A comparison of two different project summary themes
Snowcrash vs Tylium

Tylium optimizes your workspace, keeping the purpose of each view in mind. It adds space where you need more real estate for updating findings and resizes or rearranges elements when you need to see the big picture. An example of this can be seen with the collapsible sidebar that adds roughly 20% more space and keeps all sections of the app quickly accessible, even adding a dashboard link to the project summary.

animation showing a navigation bar collapsing.
Now you see it, now you don’t!

As always, we’re eager to hear what you think. If you have feedback on Tylium drop a comment here, send it via email, or share it in Slack.

*It is SOP at Security Roots that we honor our nerdoms where we can. Snowcrash, the previous theme, is a nod to Neal Stephenson’s cyberpunk novel of the same name. Our love of Battlestar Galactica continues on with the new theme, paying homage to the powerful fuel source used in the series – Tylium.

Report Generation Errors

Everyone knows that validating your report before generating it will save you a headache tracking down problems with the report later. Now, the validator is more helpful by providing additional context to help locate the problematic evidence. While we are preventing headaches if your report has errors that are detected during generation the option to download it won’t be displayed.

Oooh, there’s the problem!

Release Notes

  • Update app to new Tylium layout
  • Add the ability for kits to update an instance’s Plugin Manager templates
  • Add revision history for cards
  • Bugs fixed:
    • Updated support beacon. Legacy support was dropped for older versions
    • Fix errors on content overwrite flash messages
    • Fail and redirect to login instead of raising an error when attempting to log in as a user that has been removed
    • When a report export is invalid and errors we disable the download button to prevent further errors
    • Fix the mail initializer not finding existing configuration settings from the db
    • Fix Cancel link path for the Note Edit page
    • Fix services_extras not being excluded from Excel exports
    • Fix Rule checking for non-existent fields
  • Integration enhancements:
    • CVSSv3 calculator provides access to all Temporal/Environmental fields
  • Reporting enhancements:
    • Add support for ellipsis
    • Better Evidence references on failed validations
  • REST/JSON API enhancements:
    • Add team (team id, team name, team_since) in the teams API endpoint
  • Security Fixes:
    • High: Authenticated author can no longer continue to make project changes and will be logged out after being disabled by an admin
    • Medium: Prevent admins from updating other user’s comments

New Dradis Integration: WPScan

WPScan logo

When the WPScan team approached us in late 2019 offering to create an integration for Dradis, we were excited to work together. What goes together better than a WordPress security scanning tool and an easy way to turn those findings into a customized report? Maybe chocolate and peanut butter, but the Dradis WPScan integration is much more likely to result in a more secure website.

A screenshot of Dradis showing Issues created by the WPScan integration
Time to update WordPress 😬

WordPress powers 35% of the Internet’s websites from hobby blogs to Fortune 50 companies. WordPress’ ease of use, well-established community, and extensive plugins offerings (55,457 as of this post) make it an attractive option for creating a presence online. Unfortunately, these same charms also make WordPress an easy and frequent target for attack. 

In 2011, while investigating his own blog’s security, Ryan Dewhurst created a script that combined testing for WordPress’ vulnerabilities into a single tool. This script, now WPScan, enumerates usernames, plugins, and themes, performs brute force password attacks, and identifies the version of WordPress on a target. 

WPScan contributors went on to create WPVulnDB to manage the ever-growing list of known WordPress vulnerabilities in an online database. When used together, WPScan and WPVulnDB API provide realtime detailed vulnerabilities and recommendations in your scan results.

This new Dradis WPScan integration makes it a snap for you to import the results of your WPScan directly to a Dradis Project. Each target maps to a node within your Dradis project, any vulnerabilities found in a plugin, theme, or setup become Dradis issues, and when evidence is available – like a list of enumerated usernames – it is pulled into Dradis as evidence.

Ready to get started with Dradis and WPScan?

The steps to add the Dradis WPScan integration to Dradis CE or Dradis Pro are similar for both editions.

  • Add or edit the Gemfile.plugins file. The file locations for each edition is listed below
    • Dradis CE: top-level Dradis CE directory
    • Dradis Pro: /opt/dradispro/dradispro/shared/addons/
      • This file should be symlinked to /opt/dradispro/dradispro/current/
  • Append gem 'dradis-wpscan', github: 'dradis/dradis-wpscan' to the file
  • Save Gemfile.plugins
  • $ bundle install
  • Restart Dradis
  • 🎉 All done!

If you run into any snags with the process, reach out on the community forums, the CE or Pro Slack workspaces, or directly to support.

TL/dr: Import WPScan findings into Dradis with the new Dradis WPScan integration