{% extends "report_base.html" %} {% load static %} {% load display_tags %} {% load humanize %} {% load event_tags %} {% load get_endpoint_status %} {% load get_note_status %} {% load get_notetype_availability %} {% block content %} {{ block.super }}

Product Security Report for {{ product.name }}

Generated: {% display_date %}

{% if include_table_of_contents%}

Table of Contents for {{ product.name }}

{% endif %} {% if include_executive_summary %}

Executive Summary for {{ product.name }}

Assessment Details

Assessed by: {% if product.engagement_set.all.0.lead.first_name|length > 0 %} {{ product.engagement_set.all.0.lead.first_name }} {{ product.engagement_set.all.0.lead.last_name }} {%else%} product.engagement_set.all.0.lead {% endif %}
Scope: {{ product.name }}
{% if product %} {% if product.engagement_set.all %}

Engagement Details

{% for eng in product.engagement_set.all %}

{% if eng.name and eng.name|length > 0 %} The {{ eng.name }} {% else %} An {% endif %} engagement ran from {{ eng.target_start|date:"SHORT_DATE_FORMAT" }} {% if eng.target_end %} to {{ eng.target_end|date:"SHORT_DATE_FORMAT" }}. {% else %} and is ongoing. {% endif %}

{% if eng.test_set %}

The engagement included the following tests:

    {% for t in eng.test_set.all %}
  • {{ t }} ({{ t.environment.name|default:"unknown" }}): {{ t.target_start|date:"SHORT_DATE_FORMAT" }}
  • {% endfor %}
{% endif %} {% if eng.test_strategy %}

The test strategy for this engagement can be viewed at {{ eng.test_strategy }}

{% endif %} {% endfor %} {% else %}

No engagements found for {{ product.name }}

{% endif %}
Endpoints
{% colgroup endpoints into 2 cols as grouped_items %} {% for row in grouped_items %} {% for item in row %} {% endfor %} {% endfor %}
{% if item %} {{ item }}{% endif %}

Product Metrics

{% endif %}

A total of {{ findings|length|apnumber }} finding{{ findings|length|pluralize }} of varying severity are represented in this report.

Findings
Finding Age

This report represents a security audit performed by the {{ team_name }} team. It contains confidential information about the state of your network and applications. Access to this information by unauthorized personnel may allow them to compromise your network.

{% endif %} {% if include_disclaimer%}
Disclaimer

{{ disclaimer }}

{% endif %}
{% if engagement.test_set.all %}

Test Notes

{% for test in engagement.test_set.all %} {% if test.notes.all %} {% for note in test.notes.all %} {% if not note.private %} {{ note.author }} - {{ note.date }} - {{ note }}
{% endif %} {% endfor %} {% endif %} {% endfor %}

{% endif %} {% if engagement.risk_acceptance.count > 0 %}

Risk Accepted Findings

{% for risk in engagement.risk_acceptance.all %} {% for finding in risk.accepted_findings.all %} {% endfor %} {% endfor %}
Name Date Severity
{{ finding.title }} {{ finding.date }} {{ finding.severity }}
{% endif %}
{% if findings %}

Findings

{% endif %} {% for finding in findings %} {% ifchanged finding.severity %}

{{ finding.severity|capfirst }}

{% endifchanged %}
Finding {{ forloop.counter }}: {{ finding.title }} {% if finding.tags %} {% for tag in finding.tags.all %} {{ tag }} {% endfor %} {% endif %}
{% if finding.risk_acceptance_set.all %} {% endif %} {% if finding.mitigated %} {% endif %} {% if finding.cwe > 0 %} {% endif %} {% if finding.risk_acceptance_set.all %} {% endif %} {% if finding.mitigated %} {% endif %} {% if finding.cwe > 0 %} {% endif %}
Severity StatusAcceptanceDate discovered Age ReporterDate Mitigated Mitigated ByCWEDojo ID
{% if finding.severity %} {{ finding.severity }} {% else %} Unknown {% endif %} {{ finding.status }} {% comment %} for some reason the font-awesome icons don't work with the report template{% endcomment %} {% for ra in finding.risk_acceptance_set.all|slice:":5" %} acceptance  {% endfor %} {{ finding.date }} {{ finding.age }} days {{ finding.reporter }}{{ finding.mitigated }} {{ finding.mitigated_by }} {{ finding.cwe }} {{ finding.id }}
{% include "dojo/snippets/endpoints.html" with finding=finding destination="Report" %} {% if finding.cvssv3 %}
CVSS v3
{{ finding.cvssv3|markdown_render }}
{% endif %}
Description
{{ finding.description|markdown_render }}
{% if finding.mitigation %}
Mitigation
{{ finding.mitigation|markdown_render }}
{% endif %} {% if finding.get_report_requests %}
Sample Request(s): Displaying {{finding.get_report_requests.count}} of {{finding.burprawrequestresponse_set.count}}
{% for req in finding.get_report_requests %}
Request {{forloop.counter}}
{{ req.get_request }}
{% if req.get_response != "" %}
Response {{forloop.counter}}
{{ req.get_response|truncatechars_html:800 }}
{% endif %} {% endfor %} {% endif %} {% if finding.impact %}
Impact
{{ finding.impact|markdown_render }}
{% endif %} {% if finding.steps_to_reproduce %}
Steps to Reproduce
{{ finding.steps_to_reproduce|markdown_render }}
{% endif %} {% if finding.severity_justification %}
Severity Justification
{{ finding.severity_justification|markdown_render }}
{% endif %} {% if finding.references %}
References
{{ finding.references|markdown_render }}
{% endif %} {% if include_finding_images %} {% include "dojo/snippets/file_images.html" with size='original' obj=finding format="HTML" %} {% endif %} {% if include_finding_notes %} {% with notes=finding.notes.all|get_public_notes %} {% if notes.count > 0 %}
Notes
{% with notes_with_type=notes|get_notetype_notes_count %} {% if notes_with_type > 0 %} {% endif %} {% for note in notes reversed %} {% if notes_with_type > 0 %} {% endif %} {% endfor %} {% endwith %}
User DateNote TypeNote
{{ note.author.username }} {{ note.date }} {% if note.note_type != None %} {{ note.note_type }} {% endif %} {{ note|linebreaks }}
{% endif %} {% endwith %} {% endif %} {% endfor %}
{% if include_table_of_contents %}
{% endif %}
{% endblock %} {% block js %} {{ block.super }} {% if punchcard %} {% endif %} {% endblock %}