https://github.com/radicallyopensecurity/pentext
PenText system: Easily create beautifully looking penetration test quotes, reports, and documents in many formats (PDF, text, JSON, CSV, ...)
https://github.com/radicallyopensecurity/pentext
documentation-generator pdf pentest-report pentesting
Last synced: 27 days ago
JSON representation
PenText system: Easily create beautifully looking penetration test quotes, reports, and documents in many formats (PDF, text, JSON, CSV, ...)
- Host: GitHub
- URL: https://github.com/radicallyopensecurity/pentext
- Owner: radicallyopensecurity
- License: gpl-2.0
- Created: 2016-06-01T13:07:23.000Z (about 9 years ago)
- Default Branch: main
- Last Pushed: 2024-07-29T10:52:53.000Z (10 months ago)
- Last Synced: 2024-08-04T05:05:29.492Z (10 months ago)
- Topics: documentation-generator, pdf, pentest-report, pentesting
- Language: XSLT
- Homepage:
- Size: 6.53 MB
- Stars: 115
- Watchers: 16
- Forks: 38
- Open Issues: 8
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
Awesome Lists containing this project
README
# PenText
The PenText XML documentation project is a collection of XML templates, XML
schemas and XSLT code, which combined provide an easy way to generate IT
security documents including test reports (for penetration tests, load tests,
code audits, etc), offers (to companies requesting these tests), and invoices.
### How it Works
The OWASP PenText project is based on XML. A PenText Report, Quote, Invoice or
Generic Document is in fact a (modular) XML document, conforming to an XML
Schema. The XML Schema ensures that the documents are structured correctly, so
that they can then be transformed into other formats like PDF, CSV and JSON
using XSLT and the SAXON XSLT processor.
To produce a PDF document, the report, offer, invoice or generic document XML is
first transformed into XSL-FO (XSL Formatting Objects), which is then converted
to PDF using Apache FOP.
It is also possible to export e.g. all findings of a report to JSON, XML or
plaintext format.
### The Structure
- The framework itself consists of files in the `dtd` and `xslt` directory
- A report or quote will go into `source`
- Graphics, including screenshots and e.g. a company logo, will go into
`graphics`
- Findings and non-findings of penetration test reports can go into `findings`
and `non-findings`
## Getting Started
What do you need ?
1. Clone this repository
2. Install the toolchain
3. Edit the content
Listo! That's all you need. Now you can build PDF reports using the content.
### Toolchain
To convert the XML content into PDF files the tools the _Apache FOP_ library and
the _Java_ library _Saxon_ will be used. A separate repository will contain
these tools on a handy Docker container.
To edit (and view) the content you'll need a XML editor - which could be any
text editor like _JEdit_, to a full IDE- for editing of course ;). Preferably
something that can check XML file validity. To view the resulting PDF files a
PDF viewer is necessary.
### Building PDFs
Manually compiling a quotation, report or other document can be done using the
supplied Makefile:
`make report`
This performs
`java -jar path-to-Saxon-jar -s:name-of-xml-file -xsl:name-of-xsl-file-in-xsl-directory -o:name-for-pdf-output`
See for more detailed information the [tools manual](/doc/tools-manual.md)
### Building CSVs
To export all findings as CSV file run:
```sh
make export-csv
```
This will output all columns as separate fields as well as a "Jira Formatted
Description" field that can be used in Jira.
#### Building CSVs using CI/CD
Copy over the latest `xslt/findings2csv` to your project.
Make sure the build step in `gitlab-ci.yml` saves `.csv` files:
```yml
build:
tags:
- docbuilder
stage: build
script:
- echo "Building documents!"
artifacts:
paths:
- target/*.pdf
- target/*.csv
```
CSVs will now be generated alongside every PDF.
## Adding and Modifying Content
### Guidelines
- There is a guide for
[report writing](doc/report/Report%20Writing%20-%20Procedure.md)
- There is also a guide for
[quotation writing](doc/offerte/Offerte%20Writing%20Procedure.md)
### Example documents
Besides the reports and quotations, generic documents can also be created. Those
can be found [here](doc/examples)
## Important note
From version 2.0 onwards, the structure of the PenText repository has been
simplified. Please see the [CHANGELOG](CHANGELOG.md) for more information.