New Dradis Integration: WPScan

WPScan logo

When the WPScan team approached us in late 2019 offering to create an integration for Dradis, we were excited to work together. What goes together better than a WordPress security scanning tool and an easy way to turn those findings into a customized report? Maybe chocolate and peanut butter, but the Dradis WPScan integration is much more likely to result in a more secure website.

A screenshot of Dradis showing Issues created by the WPScan integration
Time to update WordPress 😬

WordPress powers 35% of the Internet’s websites from hobby blogs to Fortune 50 companies. WordPress’ ease of use, well-established community, and extensive plugins offerings (55,457 as of this post) make it an attractive option for creating a presence online. Unfortunately, these same charms also make WordPress an easy and frequent target for attack. 

In 2011, while investigating his own blog’s security, Ryan Dewhurst created a script that combined testing for WordPress’ vulnerabilities into a single tool. This script, now WPScan, enumerates usernames, plugins, and themes, performs brute force password attacks, and identifies the version of WordPress on a target. 

WPScan contributors went on to create WPVulnDB to manage the ever-growing list of known WordPress vulnerabilities in an online database. When used together, WPScan and WPVulnDB API provide realtime detailed vulnerabilities and recommendations in your scan results.

This new Dradis WPScan integration makes it a snap for you to import the results of your WPScan directly to a Dradis Project. Each target maps to a node within your Dradis project, any vulnerabilities found in a plugin, theme, or setup become Dradis issues, and when evidence is available – like a list of enumerated usernames – it is pulled into Dradis as evidence.

Ready to get started with Dradis and WPScan?

The steps to add the Dradis WPScan integration to Dradis CE or Dradis Pro are similar for both editions.

  • Add or edit the Gemfile.plugins file. The file locations for each edition is listed below
    • Dradis CE: top-level Dradis CE directory
    • Dradis Pro: /opt/dradispro/dradispro/shared/addons/
      • This file should be symlinked to /opt/dradispro/dradispro/current/
  • Append gem 'dradis-wpscan', github: 'dradis/dradis-wpscan' to the file
  • Save Gemfile.plugins
  • $ bundle install
  • Restart Dradis
  • 🎉 All done!

If you run into any snags with the process, reach out on the community forums, the CE or Pro Slack workspaces, or directly to support.

TL/dr: Import WPScan findings into Dradis with the new Dradis WPScan integration

Year in Review – a future Dradis feature

How many Dradis projects did you create this year? How many Issues did you find? Which were the most commonly found Issues? What was the most common severity of the Issues that you found?

Credit for this script idea goes to Marc Ligthart. His teammate reached out via the support inbox to see if we could create a quick “Year in Review” script that would list out the following:

1. Count of Projects created this year
2. Total Critical/High/Medium/Low Issues (by Tag)
3. Top 10 most found Issues (by title)
4. Top 10 most found Critical/High/Medium Issues (by title)

Dradis year in review script output example
Example output from the year in review script

You can already head over to our scripting repo and check out the Year in Review script. To use it:

1. SCP the file you your instance (e.g. to the /tmp folder)

2. Run the following in the command line as “dradispro”:
$ cd /opt/dradispro/dradispro/current/
$ RAILS_ENV=production bundle exec rails runner /tmp/year_in_review.rb

The output will list out the yearly review for all of the projects present on your Dradis instance.

Now, for the fun part? We want your feedback. If you like this idea, you’ll like version 2.0 even better. We want to include this functionality as part of the existing Business Intelligence Dashboard within Dradis. But first, we want to hear from you. What else would you like to see in a summary view like this in the BI Dashboard? What other metrics would be helpful for your team or what isn’t particularly useful about the current output? Please email our support team directly with feedback! We’re excited to continue working with you in 2020 and get you some more valuable insights into your Dradis usage along the way.

Dradis version 3.5

New in Dradis Pro v3.5

Email Notifications

Now you can have your notifications emailed to you when you aren’t working in a Dradis project. Each user can adjust their notification settings to receive them individually as they happen, in a daily digest, or not at all. Get started using email notifications by configuring the mail server on your Dradis Pro instance.

A few @mention enhancements are in this release, including loading an @mentioned user’s profile photo or gravatar so you quickly spot who is in the conversation.

Burp Suite Issue severity

The way that Burp Suite handles severity is different than other integrations. Burp assigns severity to each instance of an issue as evidence and doesn’t assign severity to the issue directly. As a result, this was leading to several pieces of evidence with different severity levels for an issue with no assigned severity in Dradis. Now, Dradis will assign the issue severity using the highest evidence severity level.

Table Sorting

Finding the information you are looking for in a long table is easier with table sorting. Tables in Dradis can be sorted by any column. Click on the column heading of your choice and presto, change-o the table is sorted.

animation of a table of security findings sorting by column heading

Release Notes

  • Email notifications
  • Add notification settings to decide how often to get email notifications
  • Add a smtp.yml config file to handle the SMTP configuration
  • Preserve SMTP configuration on updates
  • Various mention related improvements:
    • Enhance the mentions box in comments to close when it is open and the page is scrolled.
    • Fix bug that prevents the mentions dialog from appearing after navigating through the app.
    • Fix elongated avatar images so they are round once again.
    • Added avatar images to mentions in comments.
    • Load Gravatars for users whose email has been set up with gravatar.
  • Add and update methodology download links to Dradis Portal
  • Enhancement when adding new nodes to copy node label data between the single and multiple node forms.
  • All tables can be sorted by column
  • Bugs fixed:
    • Fix handling of pipe character in node property tables
    • Fix projects count not updating in teams view
    • Fix error on team page when showing primary team
    • Fix overflow issue where the content would expand out of view
    • Fix page jump when issues list is collapsed
    • Fix conflicting version message when updating records with ajax
    • Fix hamburger dropdown menu functionality.
    • Fix node merging bug when `services_extras` properties are present
    • Fix cross-project info rendering
    • Prevent content block group names to be whitespaces only
    • Fix displaying of content blocks with no block groups
    • Limit project name length when viewing a project
    • Removed bullet style in node modals
    • Validate parent node project
  • Integration enhancements:
    • Burp: Make `issue.severity` available at the Issue level
    • Nessus: Fixed bullet points formatting to handle internal text column widths
    • Nexpose: Wrap ciphers in code blocks
    • Netsparker: Fix link parsing of issue.external_references
    • Jira: Loading custom (required) fields from JIRA by IssueType and Project
  • REST/JSON API enhancements:
    • Fix disappearing owner when assigning authors to a Project using the API
    • Set the “by” attribute for item revisions when using the API
  • Security Fixes:
    • Medium: Authenticated author mentioning an existing user outside of the project will subscribe that user to the note/issue/evidence
    • High: Authenticated author was able to access unauthorized projects using the API
    • Upgraded gems: nokogiri (CVE-2019-13117)

Not using Dradis Pro on your team?

These are some of the benefits you are missing out on:

Read more about Dradis Pro’s time-saving features or what our users are saying.

Badges from security summer camp

Hacker Summer Camp 2019

Another Hacker Summer Camp is in the books. As always, there was a lot to see and do – more than any single human could hope to fit into a month, much less a week. Even so, I made it to Black Hat Tools Arsenal, BSides Las Vegas, DEF CON, and volunteered for the Diana Initiative. After a year and a half of working on the Security Roots team, I met Daniel in person and we promptly started talking shop in the middle of a Mandalay Bay hallway. I took a few hours to celebrate a milestone with a fantastic dinner and show. All of that in six days and though it was exhausting, I can’t wait to return.

Daniel and Tabatha snuck into this photo late. Photo credit to the Black Hat Tools Arsenal team.

My introduction to the hacker community was at BSides Orlando a few years back. Initially, I admit that was a bit intimidated to attend a hacker conference. Portrayed in the media as egotistical superbrains or criminals hiding beneath black hoodies ready to drain your bank account, hackers aren’t presented as a welcoming bunch. While those elements exist, what I found there and continue to experience was a group of people eager to share their knowledge and answer my constant questions. The energy and collaborative spirit of the community had me hooked. I was hungry to learn more and later that same year, I volunteered at BSides Las Vegas.

BSides Las Vegas

This year I returned to BSides Las Vegas as a volunteer with the Diana Initiative. Thanks to the generosity of BSides we had an early check-in table for Diana attendees. Much of my day I spent sharing details on the Diana Initiative from how it began, where to find tickets, to how to get involved. The overwhelmingly positive feedback was supportive of the need to increase diversity in information security. I didn’t much chance to check out the talks but there are a few on my list to watch.

Black Hat Tools Arsenal

Daniel presenting at Black Hat Tools Arsenal 2019

Black Hat is the corporate side of the whole week and had a slightly different energy. I joined Daniel for the Dradis presentation at the Tools Arsenal. In my mind, I would show up in my Dradis shirt, hand out a few stickers, and take pictures of Daniel showcasing Dradis CE. Once there, I embraced the opportunity to chat with customers and talk with people about Dradis. I found myself repeating, “If it has been a while, give Dradis CE another look – so much has changed.” 

DEF CON 27

Welcome to DEF CON 27

It can be challenging to make connections at a conference this size. Unlike other large events I’ve attended, smaller distinct groups within the con space allow you to focus your attention and find like-minded folks. No matter your interest, there is a group. There are villages, workshops, talks, meetups, parties, and one of my favorite spaces – hallcon. Finding someone to talk to is pretty easy since #badgelife has most attendees wearing roughly a pound of gear on a lanyard around Las Vegas. This year’s DEF CON badge game worked particularly well to strike up hallway conversations while asking to “boop” someone’s badge.

Tabatha’s badges. A small amount compared to some.

Our staff pirate Christoffer’s post piqued my interest in maritime security, so I made it a point to stop by the inaugural Hack the Sea village. There was a good bit of discussion about the security of our seas even in casual conversation outside of the village, ranging from ICS to the antiquated technologies observed or used onboard. I visited the IoT village long enough to swear off of my existing IoT devices (but not really). While I was there, I cheered on friends that were competing in the IoT CTF.

The evenings held additional opportunities to connect with other attendees, just as varied as the talk and villages. Who doesn’t love a blanket fort? Blanketfortcon has you covered (see what I did there?) with an adult size blanket fort and bounce pad. Hacker Jeopardy is always hilarious, but I laughed the hardest during “Whose Slide Is It Anyways” watching contestants present using a slide deck they had never seen. Parties ranged from bass-thumping events going long into the early morning to more subdued gatherings with board games and great conversation.

Diana Initiative

If I am up at 6 am in Las Vegas, it is for one of two reasons; I am still up from the night before or I am volunteering somewhere. These days it is 100% the latter option, and I was excited to join the Diana Initiate staff to run registration. It turns out I particularly enjoy running registration and check-in, which I can only attribute this to having a generally sunny disposition and a love of spreadsheets. After months of hard work with the rest of the team, it was a gift to greet attendees, speakers, and sponsors and to witness their excitement for the days ahead.

Lodrina Cherne and Tabatha with MaliciousLife swag for Diana Initiative. Photo credit Lodrina Cherne

Diana Initiative has grown from its initial years held in hotel suites and for the first time organized convention space at the Westin. This year Diana Initiative had 65 speakers across three tracks that covered both technical and non-technical skills, several villages, and a CTF. It was a nice break from the noise and crowds of the DEF CON and fostered a welcoming environment for attendees, many at Hacker Summer Camp for the first time. The quieter gathering, smaller size, and inclusivity made for an inviting atmosphere to new faces and established security professionals alike.

Do the thing.

Attending camp this year felt different than my last visit. There are noticeably more women in attendance, to the credit of organizations like WoSEC, WISP, Women’s Society of Cyberjustu, and Diana Initiative. There was plenty of evidence of the work that organizers and volunteers have put in to create an inclusive and safe week including the DEF CON support hotline and improved Code of Conduct. It was incredibly inspiring to connect with the many people that are elevating diversity and bringing change in this fantastic community.

Throughout the week, everyone I spoke with remarked that there is room for everyone in information security; quoting struggles finding qualified candidates and too-large workloads. Increasing the number of women not only brings more workers to the industry, but each person brings a unique lens to approach privacy and security challenges. No matter who you are or what your background, consider this your invitation. Show up, do the work, learn the things, and take your place. And then, share what you know. See you next year!

Tabatha at the Diana Initiative after party.

New in Dradis Pro v3.4

This post references an older release of Dradis Pro. You can find the most current version here:


Dradis Professional Edition is a collaboration and reporting tool for information security teams that will help you deliver the results of security assessments, in a fraction of the time without the time-wasting frustration of creating manual reports.

Node Methodology

Add a methodology to a node containing the details appropriate for that node type. Create and apply methodology templates to ensure everyone on the team knows the next steps for that node. Project methodologies are still available; these new methodologies bring the same consistency to nodes.

Merging Nodes

If you have ended up duplicate nodes in your project, you can now merge them and preserve any findings related to that node. The new node merge action moves all associated Notes, Evidence, Attachment, and Activities from the source node into the target node.

Highlight Inside Code Blocks

Call attention to the most important details within a code block. Wrap the section with $${{ }}$$ to highlight it in yellow. The highlights transfer to your final report using styling updated in your report template.

Collapsable Sidebars

If your project has a long list of issues or attachments, it can be unwieldy to quickly access the import fields at the bottom to add more. The sidebars are now collapsable using the chevron at the top of the list and are expanded by default. Issues, Report content, and Nodes received this UI update to help you move through a cleaner interface.

Release Notes

  • Allow nodes to have an associated methodology
  • Highlight code snippets.
  • Better new board form empty name handling
  • Fix migration paths during database setup
  • Collapsable sidebar in issues
  • Collapsable sidebar in report content
  • Better placeholder syntax in Issuelib
  • Contributor dashboard redesign
  • Fix screenshot validator when Textile screenshot links have captions
  • Add Node merging feature
  • REST/JSON API:
    • New coverage: Tester users
  • Word reports:
    • Add CodeHighlight style support
  • Add-on enhancements:
    • Nexpose: Add risk-score attribute to nodes
    • Nmap: Add port.service.tunnel field to the port template
    • Remediation tracker: tickets can be assigned to testers and contributors, and contributors can see their tickets too.

Not using Dradis Pro on your team?

These are some of the benefits you are missing out on:

Read more about Dradis Pro’s time-saving features or what our users are saying.

New Dradis script: Bulk upload

We have a new addition to our dradispro-scripting repository. The bulk_upload.sh script allows you to upload multiple tool output files (of the same type) into a Dradis project at once.

For example, you might have multiple Nmap files from scanning hosts associated with a single Dradis project. Now you can upload all those files to your project at once. To use the script:

1. Copy all the XML files for a given plugin that you want to upload to a folder on your Dradis instance, such as /tmp/nmap/

2. Copy the bulk_upload.sh file to /opt/dradispro/dradispro/current/ on your Dradis instance.

3. Make the file executable:
$ chmod +x /opt/dradispro/dradispro/current/bulk_upload.sh

4. Run the file:
$ /opt/dradispro/dradispro/current/bulk_upload.sh <project_id> <plugin> <path>

For example, if your project is at <Dradis IP>/pro/projects/4 and you want to upload multiple Nmap files from /tmp/nmap/
$ /opt/dradispro/dradispro/current/bulk_upload.sh 4 nmap /tmp/nmap/

We hope you find this script useful! Check out our other scripts at dradispro-scripting repository for other scripts you can use or adapt to improve your workflow.

New in Dradis Pro v3.3

Dradis Professional Edition is a collaboration and reporting tool for information security teams that will help you deliver the results of security assessments, in a fraction of the time without the time-wasting frustration of creating manual reports.

What’s new in Dradis Pro v3.3

Auto-Save

There are few things more frustrating than losing work in progress when your connection drops, browser crashes, or you close the wrong tab. Dradis now automatically saves your changes every few seconds to help avoid this problem. When you return to work, and auto-saved data is available, restore your work from the browser’s cached version.

Configuration Kits

Get started with Dradis Pro with a click of a button using kits. Use a Dradis kit to set up an instance tailored to your needs just by uploading a single file. A single kit zip file can quickly import and configure a project, report, issue, and evidence templates and properties, Rules Engine rules, methodologies, and sample projects. Admins can still tweak and configure Dradis manually; kits offer a simple way to jumpstart setup.

Azure DevOps / VSTS

Send any issue from a Dradis project to Azure DevOps (formerly Visual Studio Team Services / Team Foundation Server) to create a Work Item. Once sent, the Issue in Dradis displays the state of Work Item so you can keep track of remediation activities without leaving Dradis.

Ready to upgrade to v3.3?

Release Notes

  • Fix column overflow on Issues / IssueLib entries table
  • Allow report content management even without an RTP
  • Fix content blocks sorting in the sidebar
  • REST/JSON API:
    • Add-ons can inject Project attributes
    • BI custom fields included in Projects API endpoint
    • BI custom fields included in Teams API endpoint
    • Project Scheduler add-on includes :start and :end date in Projects endpoint
  • Fix sorting for issues under nodes on export
  • Add ability to upload configuration kits via web
  • Add screenshot validator
  • Projects are created with a background job
  • Two-step Contributor login

Not using Dradis Pro on your team?

These are some of the benefits you are missing out on:

Read more about Dradis Pro’s time-saving features or what our users are saying.

w00t and pillage – Captain’s bLog: day 14

I have now completed the first course in my queue! Since the last post, I have been digging into website hacking. This is of course a big area and a massive element of day-to-day information security. I went through various avenues and implementations of SQL injection attacks, XSS (Cross Site Scripting) attacks, and more. I also learned about protecting against these sorts of attacks, and had a brief introduction into how vulnerability scanning can be automated with scanning tools. Of course, once you have your scan output ready, put it into Dradis and produce a custom no-fuss report!

Trying out the SQL injection procedures was based on attacking a fake vulnerable web server in Metasploitable. Insecure database calls in SQL on a website or web application can let attackers extract or modify information, or grant access even without passwords. An SQL injection vulnerability on one site can potentially undermine the security of all sites and applications hosted on that one web server. As the instructor said, if there is an SQL injection vulnerability on the target site, bingo, game over, you as an attacker can ultimately do virtually anything you want with that site.

With XSS vulnerabilities, you essentially insert scripts to run from a site. As an example, there may be a commenting feature on a web page with an XSS vulnerability, which means that this XSS script would run for all visitors to that page. What makes this insidious is that the script would run for visitors to the page, as it’s not part of the base web page. An insecure website could therefore jeopardize the security of third parties – and therefore, owners of web pages, web applications, and web hosts have a responsibility to protect their sites so third parties are not affected.

The course closed with a very brief introduction to ZAP (Zed Attack Proxy), one of many tools to automate scanning for vulnerabilities. The point of this course was to show the theory behind security vulnerabilities, and the sort of attacks that can be carried out by hackers. Now that I have been introduced to the nuts-and-bolts, step-by-step methods of attacking devices and applications, the path is open to learning more about particular focus areas and to think about scripting and automation. I do have some more studies coming up to these ends. I intend to learn more about hacking using Android, I need to learn more about networking vulnerabilities, and I would like to learn more about scripting and vulnerability scan automation through software like ZAP and Burp, both of which have official Dradis plugins. I already manipulate their plugin outputs most days when building Dradis templates, so it would be fun to create those outputs as well!

w00t and pillage – Captain’s bLog: day 13

Lately I have been looking into the details of hacking through networks, and post-exploitation attacks. The idea was to get beyond the idea of trying out attacks on a second VM on the same device, or another device here at home, to the principle of hacking devices on other networks.

First up was freshening up on the basics of networking. From the “information gathering” step I should have multiple ways of potentially feeding backdoors to the target device. Then there was an exercise of doing so, using BeEF – essentially the same exercise as before, with only some minor changes to function with the outside network. That demonstrated the principle, so we moved on to a look at post-exploitation attacks.

Post-exploitation attacks were run with metasploit through veil-evasion. That generated a robust connection with meterpreter that should be essentially undetectable by antivirus programs. The challenge is of course to manage the original connection, but with that accomplished, meterpreter allows all sorts of scripts to be run as well as terminal access.

In effect, that meant running all the sorts of attacks that people should be paranoid about; keylogging, capturing screenshots of the target device, controlling the camera and/or microphone, altering the files on the target device, and so on. Fun! Metasploit has so many functions and capabilities that going through them in detail was beyond the scope of this course.

Now that the possibilities of post-exploitation attacks had been made clear, the course moved back to networking, to cover pivoting. Pivoting allows hackers to target other devices in the same network as an infected device. Even if the hacker’s device has no access to the final target devices, if they can attack a device in the same network as the final target, they can route their attacks through the infected device. That is another cool exploit, and hammers home how important security is on servers and routers.

As the course progresses, I believe I get a far better understanding of our Dradis users’ use cases. When I build custom Dradis templates and configure projects, of course there’s always some variation of issue descriptions, screenshots, and usually evidence output. These post-exploitation attacks and network penetration efforts are exactly the sort of vulnerabilities that Dradis is set up to report, and screenshots of my work would make good evidence output.

I do feel that in the last weeks’ studies I have been heavy on the theory and observation, but light on actual practise. I intend to set up a few devices and VMs to practise attacking, and I have permission to try to attack some other peoples’ personal devices. Let’s see how that goes; beyond that, the rest of the current course covers website hacking, which will also be fun!

New in Dradis Pro v3.2

Dradis Professional Edition is a collaboration and reporting tool for information security teams that will help you deliver the results of security assessments, in a fraction of the time without the time-wasting frustration of creating manual reports.

What’s new in Dradis Pro v3.2

Here is Rachael with a quick video summary of what’s new in this release:

Integrated CVSSv3 Calculator

Quickly generate a CVSSv3 Risk score for an individual issue directly in Dradis. The CVSSv3 score calculator is now included as a tab on each issue for handy access. Edit the values on the calculator to populate the issue’s CVSSv3 details, including a valid vector string, with no need to copy and paste!

Animation showing the CVSSv3 calculator populating the base score and vector for a security issue.

IssueLibrary ships with Dradis Pro

Ever wish that the IssueLibrary wasn’t a separate installation and upgrade process from Dradis Pro? Wish no more! IssueLibrary is now bundled with Dradis Pro.

If you haven’t been using IssueLibrary, now is your pain-free opportunity to give it a spin. Cultivate a collection of your finest vulnerability descriptions to reuse across your Dradis Pro projects.

Already have vulnerability descriptions in another format outside of Dradis? Reach out to our support team and they can set you up to easily migrate them into IssueLibrary.

Upgrading from an earlier version of the IssueLibrary?
You must first remove IssueLibrary before applying the DUP by deleting the IssueLibrary line from /opt/dradispro/dradispro/current/Gemfile.plugins.

IssueLibrary API endpoints

The IssueLibrary is the newest API endpoint to be added to Dradis Pro. Use this new endpoint to create, update, retrieve and delete IssueLibrary entries. Check out the IssueLibrary API guide for examples to get started.

Ready to upgrade to v3.2?

Release Notes

  • Use ajax in comments
  • Fix nodes sidebar header margin
  • Add bold font to improve bold text visibilit
  • Fix links display in Textile fields
  • Fix redirection destinations after edit/delete evidence
  • Refactor cache keys in pages with comments
  • Disable turbolinks cache when displaying flash messages
  • Sort attachments in alphabetical ASCII order
  • Fix methodology checklist edit error
  • Add contributors and contributors management
  • Add IssueLibrary to the main app – no manual upgrades!
  • Fix export error caused by whitespace between newlines
  • Fix auto-linking export error for non-latin characters, dashes, and parenthesis
  • Fix multiple permissions added to a project when created via API
  • Add default tags to new project templates
  • Fix the bug that caused project to disappear when an author updates a project
  • Add seeds for the rules engine
  • Fix user count in teams list
  • Add contributor management view hooks for the Teams and Users pages
  • Allow deletion of teams with users
  • Show project Custom Properties in Business Intelligence – Trend Analysis
  • Fix XSS vulnerability when uploading svg attachments
  • Fix XSS vulnerability when evidence were sent to Trash
  • REST/JSON API:
    • New endpoint: IssueLibrary entries
  • Add-on enhancements:
    • CVSS calculator: embed CVSSv3 calculator in Issue page
    • Acunetix: Resolve create_node errors that appeared with URLs wo/ “http”
    • Burp: Make `issue.detail` available at the Evidence level
    • Netsparker: Change alphabetical lists to bullet lists

Not using Dradis Pro on your team?

These are some of the benefits you are missing out on:

Read more about Dradis Pro’s time-saving features or what our users are saying.