Search for Findings in Reports

[BrunoTeixeira1996]

Is your feature request related to a problem? Please describe.
I'm always frustated when some collegue does not create a custom Finding and I need to lookup each previous report to find what they did do describe let's say a CSV Injection.

Describe the solution you'd like
A cool feature would be to have a search for a finding but inside the reports so I can lookup what my collegue wrote when describring a finding that is not in the finding tabs.

Would this be possible? Thanks

[ArgentEnergy]

@BrunoTeixeira1996 @chrismaddalena

I believe what Bruno is asking is what we do at my work. I wrote a custom web page that allows me to filter report findings based on tester, date, keywords (e.g. JWT, XML, GraphQL, etc...), and then click the finding title to go to the report.

You'll probably have to re-adjust our code as we use the affected entities field as the finding evidence field to write up all our finding details and we use some other fields as shown in the screenshot to categorize findings into buckets (e.g. Authentication, Encryption, etc...).

https://github.com/StratumSecurity/Ghostwriter/blob/5219255bd7397440b16ff3c0435a5dedc271e6a2/config/urls.py - has the entry for the URL mapping: report/findings/
https://github.com/StratumSecurity/Ghostwriter/blob/5219255bd7397440b16ff3c0435a5dedc271e6a2/ghostwriter/stratum/filters.py - code to handle different types of filtering
https://github.com/StratumSecurity/Ghostwriter/blob/5219255bd7397440b16ff3c0435a5dedc271e6a2/ghostwriter/stratum/templates/report_findings_list.html - webpage HTML code
https://github.com/StratumSecurity/Ghostwriter/blob/5219255bd7397440b16ff3c0435a5dedc271e6a2/ghostwriter/stratum/urls.py - URL mapping
https://github.com/StratumSecurity/Ghostwriter/blob/5219255bd7397440b16ff3c0435a5dedc271e6a2/ghostwriter/stratum/views.py - API code for the page
https://github.com/StratumSecurity/Ghostwriter/blob/5219255bd7397440b16ff3c0435a5dedc271e6a2/ghostwriter/templates/base_generic.html - has the Search Report Findings menu item entry there

[BrunoTeixeira1996]

@ArgentEnergy that is exactly what I was looking for however I can't use your fork at work but I think this would be a realy cool feature.
I was thinking on doing something similar just by using a cli something like a grep but I had to have admin rigths for that

[chrismaddalena]

We're tracking this and will see what we can implement 😄

[github-actions]

This issue has been labeled as stale because it has been open for 30 days with no activity.

[github-actions]

This issue is closed because it has been inactive for 14 days since being labeled stale. Feel free to re-open the issue with a comment. If this needs further discussion (e.g., a feature request), it might be better to open a topic under the Discussions tab.

[BrunoTeixeira1996]

Any update? @chrismaddalena

[chrismaddalena]

This issue is closed but tracked on the road map. No update on this one yet, but we'll look at ArgentEnergy's implementation.

[BrunoTeixeira1996]

This issue is closed but tracked on the road map. No update on this one yet, but we'll look at ArgentEnergy's implementation.

Awesome, thanks for the feedback!