OWASP - FACTION PenTesting Report Generation and Collaboration Framework

GitHub last commit GitHub Release Date - Published_At

Faction is now an OWASP Project! You can find more information here

Sponsors

Premium Sponsors

<table style="background:white"> <tr> <td align="center"> <a href="https://www.otto-js.com"><img style="width:100px; margin-right:30%; margin-left: 30%" src="https://www.otto-js.com/assets/otto-blue-logo.jpg"/></a><br/><a href="https://www.otto-js.com">otto-js - PCI and Client Side Security</a> </td> <td align="center"> <a href="https://secninjaz.com/"> <picture> <source media="(prefers-color-scheme: dark)" srcset="backers/white-horizontal.svg"> <source media="(prefers-color-scheme: light)" srcset="backers/black-horizontal.svg"> <img alt="SecNinjaz Technologies LLP" src="backers/Secninjaz+Logo+with+outline+01.svg" style="padding-bottom:25px; margin-top:30px"> </picture> </a><br/><a href="https://secninjaz.com/">Secninjaz Technologies LLP</a> </td> </td> </tr> </table>

If you like the project and would like to see it advance then consider being a sponsor. All sponsors get access to the Faction discord server and will have bug reports prioritized. Just click the sponsor links at the top of this repo or contact us at info[at]factionsecurity.com

Community, Getting Involved, and Updates

Join the OWASP Slack Community and and follow #project-faction! Be sure to follow us on BlueSky and our Blog to get the latest updates.

Contributing

Please see our contributing guidelines for details and standards on contributing before considering or submitting a pull request.

Introduction

FACTION is your entire assessment workflow in a box. With FACTION you can:

Automate pen testing and security assessment Reports
Peer review and track changes for reports
Create customized DOCX templates for different assessment types and retests
Real-time collaboration with assessors via the web app and Burp Suite Extensions
Customizable vulnerability templates with over 75 prepopulated
Easily manage assessment teams and track progress across your organization
Track vulnerability remediation efforts with custom SLA warnings and alerts
Full Rest API to integrate with other tools

Other Features:

LDAP Integration
OAUTH2.0 Integration
SMTP integration
Extendable with Custom Plugins similar to Burp Extender.
Custom Report Variables

Want to see it in action? -> Faction YouTube Channel

Quick Setup

Requirements

Java JDK11
Maven (for building the project)
(Optional for VM). Mongo DB requires a CPU with AVX support. You may run into this issue if using Oracle Virtual Box or Kubernetes

Run the following commands to build the war file and deploy it to the docker container.

git clone git@github.com:factionsecurity/faction.git
cd faction
docker-compose up --build

Once the containers are up you can navigate to http://127.0.0.1:8080 to access your FACTION instance.
On the first boot, it will ask you to create an admin account.

Import the Vulnerability Templates

Navigate to Templates -> Default Vulnerabilities
Click Update from Faction.

Customize reports

You can find out more information about creating your own custom report templates here:
Custom Security Report Templates - Faction Security

Burp Suite Extension

Burp Suite Extensions

Manuals and Tutorials

Manual

Don't want to host it yourself?

We can provide hosting for your instance. All instances are single tenants so you don't have to worry about sharing infrastructure with untrusted parties. Navigate to https://www.factionsecurity.com to learn more.

Screenshots

Vulnerability Templates

Assessment Scheduling

Peer Review and Track Changes

Remediation/Retest Queue

Schedule Retests

Assessor Retest Interface

Vulnerability Status Tracking

1.2 Release Updates

Faction 1.2 introduces the App Store! The Faction App Store will make it easier for developers to extend faction. Faction Extensions can be used to trigger custom code when certain events happen in your workflow like sending all vulnerbilities to Jira when the assessment is complete or update a tracking system when retests pass or fail. More information can be found in the documentation site.