ORG (OWASP Report Generator)
The ORG (OWASP Report Generator) is a tool for Security Consultants that supports the documentation and reporting of security vulnerabilities discovered during security audits.
The source code for latest stable version can be downloaded from here (updated on 11/1/2006): Report Generator Source
This project is in active development and the latest version can be obtained from Google SVN
Instructions for using the zip file
1) Unzip the files
2) Run regAuthenticPlugin.bat to register the AuthenticPlugin
3) Open the solution in VS.Net 2k5. You can use any version of VS but the primary version used for development is the express edition.
4) More than likely you need to modify the references area to use the local files for [IxInterop|AxInterop].XMLSPYPLUGIN.
5) Then try and compile and you should be good to go. If not contact Mike and we will work with you to get it all straightened out and so we can adjust this process.
The current version under development is v0.86 and you can see the change log here: ORG (Owasp Report Generator) - Change Log
The current Todo is here: [[ORG (Owasp Report Generator) - To Do
Getting setup for an assessment
Step 1) Create a profile for you to use on your computer. You can do this on the first screen that will be encountered when running ORG.
Once the information has been inputted click on “Start Pen Test Reporter” and you are ready to start adding new projects.
Step 2) The next step is to create a project. With the “Current and Archived Projects” window open make sure that the project metadata tab is selected. From there in the lower left hand corner you will see an area to type in a new project and then click “Add”. You will then see a window like the one below.
You can now type in the pertinent information about your project. After that you are ready to identify your targets and start attacking (i.e. the fun part!).
Step 3) Next click on the targets tab, this will allow you to define the targets for your assessment. Below is a screen shot of an example of a target during an assessment.
The above area gives you the logistics of the target things like name, IP(s), the type of target and common dns names. The bottom area allows you to put files related to the target.
You can also import in targets from an NMap scan if you use the xml output file option. To do import targets click the “Import Targets” button and select the saved scan.
Step 4) After defining the attack targets you can specify the individual tasks you wish to perform on the targets. A screen like the one below should be shown.
Using this screen you can manage the tasks that need to be done for an assessment, things like information gathering, auditing of source code and other tasks that are normally done during a security audit. You can specify the state of each task with the drop down in the status column.
We now have all the background information but we need a way to let our customers know what we have found that is where the findings tab comes into play.
ORG Active Developers
- ORG (Owasp Report Generator) - Mike de Libero
- ORG (Owasp Report Generator) - Dinis Cruz
- ORG (Owasp Report Generator) - Zi Jin
Other related [OWASP .Net Project Downloads]