Dradis Professional Edition is a collaboration and automated reporting tool for information security teams.

Just in time for the new year a fresh release of Dradis Pro is out of the oven. We’re really excited about Dradis Pro v2.0 as it is going to allow you to have a much better understanding of what is going on in all your security assessments.

The highlights:

• Activity Feed: see what others are doing (see below)
• Content revisions: track and *diff* edits (see below)
• REST API: Clients and Projects
• New Change Value action for the Rules Engine
• Open support ticket from the app
• Better issue Tagging support
• Scheduled DB cleanup
• DB performance enhancements
• New add-ons
  • Brakeman Rails security
  • Metasploit Framework
• Word reports
  • Better handling of screenshots
  • Pre-export validator (see below)
  • Add .docx / .docm support CLI generation
  • Report template properties (see below)
• Plugin enhancements:
  • Acunetix issue identification accuracy
  • LDAP integration
  • NMap CLI bug fixed
  • NTOSpider additional data gathering
  • NTOSpider Plugin Manager bug fix
  • Qualys port and protocol information
• Security fixes

Bugs fixed: #223, #301, #303, #307b

Dradis v2.0 video summary

The most juicy features in a 1m32s video:

The Activity Feed

The new Activity Feed is displayed on every view of the project. It lets you see who has been working on what (and when).

In the Project Summary page, the feed looks like this:

The project activity stream.

There is an Activity Feed for issues, evidence, notes and nodes, so nothing will slip through the cracks.

Versioned content

In addition to knowing who did what and when, we’ve taken it one step further: it is now possible to view and compare the changes that were introduced in any piece of content during the lifetime of the project:

The Activity Feed view from the Project Summary page.

Report template properties and pre-export validator

Finally a handy feature on the reporting front. Since Dradis doesn’t force you to change the way you write your report, we don’t make any assumptions about how you want to work (trivia fact: Dradis has been used by over 200 teams in 32 countries and dozens of languages). As a result some times there is a small discrepancy between the content in your Dradis project and what your report template is expecting.

For example, say you use High, Medium and Low for risk rating. Maybe in one of the issues somebody made a typo and used Hihg instead of the appropriate spelling. Or say that your template is expecting you to define properties for Project name and Client point of contact but your forgot? Fear not, the new pre-export validator is here to help!

The pre-export validator in action.

So far we’ve got the following checks, but we’re already working in the next batch:

• Document Properties validator
• Issue fields and values validator
• Node labels

How to upgrade to Dradis Pro v2.0?

Just head over to the release page and follow the instructions:

https://portal.securityroots.com/releases/latest

Still not a Dradis user?

These are some of the benefits you’re missing out:

• Automated reports, generate the same reports your clients know and love in a fraction of the time.
• Combine the output from 19+ different tools into a single report.
• Deliver consistent results. Never forget any steps. Always know what has been covered and what is still ahead.
• Everyone on the same page: all information available across the team.
• Dradis Professional is reliable, up-to-date and with comes with quality support

Read more about Dradis Pro’s time-saving features, what our users are saying, or if you want to start from the beginning, read the the 1-page summary.

Today we’re happy to announce a new release of Dradis Professional Edition: Dradis Pro v1.12. Dradis is a collaboration and automated reporting tool for information security teams.

The highlights:

• New Accunetix and NTOSpider connectors
• Updated Burp and OpenVAS connectors
• Business Intelligence add-on (see below)
• Rules Engine add-on (see below)
• Reporting engine enhancements:
  • Pre-export validator
  • Native support for .docx and .docm
  • IssueCounter control
  • Concurrency enhancements
• Bugs fixed and feature requests: #128, #131, #141, #145, #152, #184, #189, #197, #201, #205, #207, #212, #216, #232, #238, #239, #254

Rules Engine add-on

Define rules that kick in when you upload the output of a scanner. Akin to your email client processing rules, the Rules Engine allows you, among other actions, to:

• Tag findings based on their fields (e.g. tag as Critical if CVSSv2 is > 9)
• Merge several findings into a single one (e.g. group all those pesky “missing patches” entries under a single finding)
• Replace the default description with your own. That’s right, every time Burp finds XSS, you will get a finding with your team’s custom Description / Recommendation for this vulnerability class.

Define the rules that will kick in when you upload the output of a scanner.

Sample rule: de-duplicate findings.

Sample rule: use your own descriptions.

Business Intelligence add-on

Most likely you’re running 100s of projects each year. The Business Intelligence add-on helps you make sense of the wealth of information that is at your fingertips but that most likely you haven’t been tracking. These are some of the questions you will be able to start answering:

• What do you know about the types of projects you’re running (what percentage is webapps vs infrastructure)?
• What types of clients are you serving? In what industry?
• How are the most profitable client types?
• What percentage of your projects is under-scoped or over-scoped?
• …

The Business Intelligence dashboard. Define custom properties for Clients and Projects to track business metrics.

New admin layout

Yes, we finally have a layout like it’s 2015 (well maybe 2013), but a great improvement over our bare-bones previous one. Here are just a couple of quick examples:

Project section view.

All users registered in the Dradis Pro instance.

How to upgrade to Dradis Pro v1.12?

Just head over to the release page and follow the instructions:

https://portal.securityroots.com/releases/1.12.0

Still not a Dradis user?

These are some of the benefits you’re missing out:

• Automated reports, generate the same reports your clients know and love in a fraction of the time.
• Combine the output from different tools into a single report.
• Deliver consistent results. Never forget any steps. Always know what has been covered and what is still ahead.
• Everyone on the same page: all information available across the team.
• Dradis Professional is reliable, up-to-date and with comes with quality support

Read more about Dradis Pro’s time-saving features. Or if you want to start from the beginning, read the the 1-page summary.

Today we’re happy to announce a new release of Dradis Professional Edition: Dradis Pro v1.11. Dradis is a collaboration and report generation tool for information security teams.

The community of Dradis users is very passionate about their craft and they rely on us to run their infosec practice. We live to make their lives better by moving out of their lives as much of the grudge work and repetition involved in delivering each project. Part of that effort also consists on creating great documentation to make the most out of Dradis, and we have two new manuals:

• Working with projects: covering every module you will use on a day-to-day basis when running a project with Dradis.
• Custom Word reports: showing you how our flexible reporting engine can be used to adapt your existing report template.

As promised a few months ago, we keep our focus on software quality and continuously raising the bar for ourselves. As a result this release is more about stability, performance, and enhancing existing functionality than it is about introducing flashy new features (not that we’re not working on flashy new features, of course we are, and they’ll blow your socks off when you see them, but they are not part of this release ;)).

Without further ado, the highlights of this release:

• Performance improvements for really large projects. Running internal assessments with 100s of hosts and 1000s of vulnerabilities is completely painless.
• Enhancements to the reporting engine:
  • Filter Issues by tag
  • Better screenshot support
  • Better paragraph / text styling detection
  • Better internal formatting (when inside Word tables)
  • Background report generation
• Onboarding Tour for new users
• In-project methodology editor
• Drop old interface support
• Bugs fixed: #20, #24, #50, #52, #55, #74, #142, #143, #146, #147, #151, #159

How to upgrade to Dradis Pro v1.11?

Just head over to the release page and follow the instructions:

https://portal.securityroots.com/releases/1.11.0

Still not a Dradis user?

These are some of the benefits you’re missing out:

• Automated reports, generate the same reports your clients know and love in a fraction of the time.
• Combine the output from different tools into a single report.
• Deliver consistent results. Never forget any steps. Always know what has been covered and what is still ahead.
• Everyone on the same page: all information available across the team.
• Dradis Professional is reliable, up-to-date and with comes with quality support

Read more about Dradis Pro’s time-saving features and pricing. Or if you want to start from the beginning, read the the 1-page summary.

Today we’re happy to announce a new release of Dradis Professional Edition: Dradis Pro v1.10.

March 2014 has been a great month: first we took part in Corelan Team’s 5th Anniversary party then we attended the first edition of the Rooted Warfare event and now we have a fresh release ready for you (yes, yes, technically we’re not in March any more, but it’s close enough!).

It’s been only 3 months since our last release, but this one is full of action:

• A more useful Project Summary view (see below).
• Tag issues and group them by tag.
• New Project Template manager.
• Performance improvements to several plugins (Nmap, Word, etc.)
• Improvements to the management console (see below).
• Several improvements on the UTF-8 and i18n front.
• And of course bug fixes, lots of bug fixes
  (#43, #44, #64, #65, #72, #75, #77, #78, #85,… full list)

Lets get a closer look of some of the most significant enhancements…

Interface improvements

This is what the new Project Summary page looks like:

All in all, the new Project Summary gives you a nice big picture overview of what is going on with the project. This is great for team leaders and technical directors wanting to keep an eye on the projects across the board. And if the client asks for an update, you’ll have all the information you need in a single screen. Nice and easy.

Lets delve into the key components of this new summary view.

Finding tagging

First of all, it is now possible to group and tag your findings. You can define your own categories and colors or you can use the default ones, up to you.

In terms of doing the real assigning, a nice drag-and-drop interface makes it a very straightforward and intuitive process:

Track methodology progress

Testing methodology support was introduced some time ago. However in this release we’re making it a lot easier to keep track of how much progress you and your team have made.

You can of course create your own testing methodologies. But remember that to help you get started there are quite a few already available in the Resources section of our Users Portal:

http://securityroots.com/dradispro/extras.html

Management console improvements

We’ve some good news on the Dradis CIC as well.

There are a few services ticking along in the background to make sure you have a great Dradis Pro experience. Every once in a while however, you may want to restart some of this services (e.g. you developed a new custom plugin, you made a change to your MySQL config, etc.). Before you had to roll up your sleeves and prepare for some good old console goodness. Not any more! From now on, it is possible to check the status of the different services and restart them from the web interface itself:

How to upgrade to Dradis Pro v1.10

Just head over to the release page and follow the instructions:

https://portal.securityroots.com/releases/1.10.0

Still not a Dradis user?

These are some of the benefits you will get:

• Spend less time writing reports, generate custom Word reports with 1 click.
• Merge the output from different tools into a single report.
• Use testing methodologies to guide your testing.
• Everyone on the same page: all information available across the team.
• Pro is reliable, up-to-date and with comes with quality support

Read more about Dradis Pro’s time-saving features.

Today we’re happy to announce a new release of Dradis Professional Edition: Dradis Pro v1.9. Start thinking about what you are going to do in 2014 with all the report-writing hours that Dradis will save you from spending 🙂

This release brings new features and improvements at almost every level:

• Redesigned interface (see below).
• New management console and upgrade process (see below).
• A faster, more reliable stack (see below).
• Enhancements to reporting engine:
  – Custom Word tables (read more)
  – Mix Issues as Notes throughout the template
• Drag’n’drop report template manager (read more).
• Add methodologies and checklists to your project templates.
• And of course bug fixes, lots of bug fixes (#7, #22, #26, #33, #34, #46, #47, #51, #59,… )

Lets get a closer look of some of the most significant enhancements…

New interface

Throughout 2013 Dradis Pro has been used by dozens of organizations around the world to manage hundreds of security engagements. Each project is a complex mix of tasks: writing up a vulnerability, processing the output of a tool, uploading a screenshot, etc. We have redesigned the Dradis interface to declutter your project workspace and make it easier to perform those tasks that you need to do several times per day.

Without further ado, the new Dradis Pro v1.9 interface:

A clean layout that lets you focus on what’s important: your findings. It’s also fluid which will help you make the most of your wide screen.

Here are a few additional close-ups, and yes, you can drag’n’drop your attachments or even paste your screenshots directly, without saving them on a file (if your browser supports it).

Management console & upgrade process

From now on upgrading your Dradis Pro install will be even easier. We’ve created a new management console that lets you apply updates without leaving your browser window.

Apart from the new Dradis CIC, we’ve also made significant changes to the base operating system layer of the Dradis Pro virtual appliance, you should upgrade as soon as possible (review the Exporting, importing and backing up your data step-by-step guide).

New stack: Ruby 2.0, Unicorn, and Nginx goodness

With Dradis Pro v1.9 we’re upgrading the base stack that powers the application.

The new stack is significantly faster and more efficient (it’s the same one that people like Github, Airbnb or ZenDesk are using). From the user’s point of view, you’ll just notice better performance under the hood.

We’ve also made some changes to the internals of the appliance paving the road to more advanced CIC operations (like restarting services from the administration console). We’ve also taken steps to make sure that further tweaking the stack will be a painless process, which will make things easier in the long run.

Still not a Dradis Pro user?

These are some of the benefits you are missing out:

• Spend less time writing reports, generate custom Word reports with 1 click.
• Merge the output from different tools into a single report.
• Use testing methodologies to guide your testing.
• Everyone on the same page: all information available across the team.
• Pro is reliable, up-to-date and with comes with quality support

Read more about Dradis Pro’s time-saving features.

Today we have pushed a new version of Dradis Professional Edition: Dradis Pro v1.7. This is the result of eight months of hard work, a bit longer than usual, but the release is packed with lots of handy improvements.

Here are some changes:

• New Issue/Evidence architecture: read about why this is a big deal.
• New all-in-one view (more below).
• New “by host” and “by issue” reporting (more below).
• New default project / report template: to make it easy for you to build on top of it.
• New interface to import Issues from external sources.
• New Qualys upload plugin.
• Updated plugins
  • Burp upload
    • Generates Issue/Evidence
    • Is orders of magnitude faster.
    • Integrates with the Plugin Manager.
  • MediaWiki import is now compatible with versions 1.14 -> 1.21
  • Nessus upload generates Issue/Evidence
  • Nexpose upload generates Issue/Evidence
• Updates and internal improvements:
  • Updated to Rails 3.2.13
  • Improved code block and table styling

All-in-one view

Notes, issues and attachments all in a single place:

And an improved interface to import form external sources:

And of course, you also get Dradis’ Smart Refresh goodness:

More screenshots

“By host” and “By issue” reporting

We have discussed multiple times how providing a useful deliverable is part of what makes a pentest firm great. With this release of Dradis Pro we’re introducing even more flexibility to our reporting engine.

It is now possible to write an issue description once and associate it will multiple hosts. Then in your report you can either present each issue along with all the affected hosts (and associated evidence) or the other way round: a host-by-host summary where you least each host under scope along with all the issues that affect it.

This flexibility is what saves our users 2 hours of reporting time in every project.

Still not a Dradis Pro user?

These are some of the benefits you are missing out:

• Spend less time writing reports.
• Merge the output from different tools into a single report.
• Use testing methodologies to guide your testing.
• Everyone on the same page: work towards a common goal.
• Pro is reliable, up-to-date and with comes with quality support

Read more about Dradis Pro’s time-saving features.

Today we have pushed a new version of Dradis Professional Edition. This is the result of two months of hard work. It is a shorter release cycle than usual, but there are some good reasons for it. We think it will make our user’s day-to-day work significantly more efficient.

Here are some changes:

• Improved Word 2010 reporting (more below):
  • The styles you apply in Dradis are kept when generating the report.
  • Easy note filtering and grouping in the report (e.g. list of High-impact findings).
• New testing methodology support (more below).
• New Client Manager to group your projects.
• Fresh look & feel (screenshots).
• Lots of minor updates:
  • With the new Quick Filter locating clients, projects and users is a breeze!
  • Updated VulnDB HQ plugin to support v2 of the API.
  • Updated to Rails 3.2.8

Improved Word 2010 reporting

Creating complex pentest report templates has never been easier. You just need your copy of Word and a few minutes. Of course we have extensive documentation in our support site, but here are the highlights:

Note styles

Add notes in our WYSIWYG editor and the styles will be kept in the report:

Note filters

Word is the only tool you need to create powerful templates

Get the report without breaking a sweat:

Testing methodologies

This is a game changer. Tracking progress during an engagement is always a daunting task. No matter how experienced you are, if you don’t play close attention, you might be missing something.

Enter our testing methodology support:

You can define as many methodologies as you need (e.g. webapp, wireless, code review, etc.) and you can add them to your projects. For instance, a typical webapp assessment will have a web testing methodology and maybe a web server checks methodology.

Keep track of progress and split tasks amongst team members. Using a standardized testing methodology is the best way to obtain consistent results.

Still not a Dradis Pro user?

These are some of the benefits you are missing out:

• Less time writing reports
• Provide a consistent experience to your clients. Every time.
• Pro is reliable, up-to-date and with comes with quality support

Read more in Why to give Dradis Professional Edition a try?

Today we have pushed a new version of Dradis Professional Edition. This is the result of four months of hard work.

Changes include:

• Upgraded look & feel (screenshots).
• Improved Word 2012 reporting:
  • Custom screenshots.
  • Custom document properties.
  • Fully integrated with support for note re-ordering.
• Drag’n’drop file uploads with pre-upload preview.
• New Plugin Manager (more below).
• New Note Templates (more below).
• New Format Cheat Sheet (more below).
• Lots of minor updates:
  • Updated NeXpose plugin.
  • Improved Forgotten password.
  • Improved markup editor with full-screen support.
  • Updated to Rails 3.2.6

Plugin Manager

The Plugin Manager puts all the Dradis Plugins plugins to work for your organization.

You can now customize how the different plugins create their notes. This means that all plugins can generate notes in exactly the format you need for your report template.

This is how the main interface looks like:

And the note template editor with live preview:

That’s right, you can map from the plugin’s native fields into the fields you need for your report. That’s going to save you an incredible amount of time!

Note Templates

Tired of typing the same fields in your new notes again and again? With this release we introduce note templates:

Create templates that include the fields that you will need for your reports, or different templates for different clients. Then whenever you are adding a new note you will be able to choose whether you want an empty note or to use one of the templates:

Format Cheat Sheet

Not familiar with Textile markup? No problem! Now the note editor features a mini cheat sheet with some of the styles you are most likely to need to create rich notes:

Still not a Dradis Pro user?

These are some of the benefits you are missing out:

• Less time writing reports
• Provide a consistent experience to your customers
• Pro is reliable, up-to-date and with comes with quality support

Read more in Why to give Dradis Professional Edition a try?

A new version of Dradis Pro is available to download. Apart from performance tweaks and bug fixes the major improvements in this release are smart refresh and project templates.

Project templates

Project methodologies can be used to provide a template for new projects.

It is likely that project of a given class (e.g. webapp assessment) will have a similar structure (e.g. scope, authentication, access control, etc.).

You can use a project methodology to create a template that contains the standard nodes and notes required for a specific project class.

You can also use the methodology to ensure that certain checks are always performed (e.g. verify logout implementation) ensuring that all your projects are consistent.

Smart refresh

Get instant updates with the information your team mates are adding to your Dradis project:

Dradis 2.8 smart Ajax refresh por etdsoft

[this feature will also be available in the upcoming community Dradis 2.8]

Want to give it a try?

If you would like to give Dradis Pro a try, please contact us or ping us on Twitter: @securityroots.

Find out more:
http://securityroots.com/dradispro/

These are some of the new features in Dradis Professional edition:

New layout

• Three-columns to maximize the amount of useful information on screen
• Better context menus: add special node types and reassign notes easily

Advanced XSLT reporting

Dradis Pro now generates an intermediate XML file containing all your notes. This will contain both the raw Text and the custom fields you created for each note:

  
    
      
      
        Value1
        Value2
        [...]
      
    
    [...]
  

Then a XML transformation can be applied to this document to generate a report.

You can see a couple of XSLT files in ./vendor/plugins/advanced_word_export/templates/:

• basic.xslt: is a very basic transform that just creates a new XML document from the data in the Dradis XML.
• simple_report.xslt: is a transform that generates a WordXML document.

Create custom fields in your notes:

And use them in your reports, in any way you need:

So with 1.1, if you’re so inclined, you can create your own XSLT transforms to produce your reports in no time. Word is just one example. Any XML-based format is generated just as easily.

Of course if you don’t have an in-house XSLT-wizard at Security Roots we will be more than happy to help and create custom XSLT for your organization in no time! Report customization was always part of our professional services offering.

Other changes

• An independent version module! Finally an easy way to know what version of Pro are you running.
• Improved table styling inside notes
• Rails 3.0.10
• Bug fixing (read-only records, sign up process, project edit form…)