Dradis Professional Edition is a collaboration and reporting tool for information security teams that will help you deliver the results of security assessments, in a fraction of the time without the time-wasting frustration of creating manual reports.

Node Methodology

Add a methodology to a node containing the details appropriate for that node type. Create and apply methodology templates to ensure everyone on the team knows the next steps for that node. Project methodologies are still available; these new methodologies bring the same consistency to nodes.

Merging Nodes

If you have ended up duplicate nodes in your project, you can now merge them and preserve any findings related to that node. The new node merge action moves all associated Notes, Evidence, Attachment, and Activities from the source node into the target node.

Highlight Inside Code Blocks

Call attention to the most important details within a code block. Wrap the section with $${{ }}$$ to highlight it in yellow. The highlights transfer to your final report using styling updated in your report template.

Collapsable Sidebars

If your project has a long list of issues or attachments, it can be unwieldy to quickly access the import fields at the bottom to add more. The sidebars are now collapsable using the chevron at the top of the list and are expanded by default. Issues, Report content, and Nodes received this UI update to help you move through a cleaner interface.

Release Notes

• Allow nodes to have an associated methodology
• Highlight code snippets.
• Better new board form empty name handling
• Fix migration paths during database setup
• Collapsable sidebar in issues
• Collapsable sidebar in report content
• Better placeholder syntax in Issuelib
• Contributor dashboard redesign
• Fix screenshot validator when Textile screenshot links have captions
• Add Node merging feature
• REST/JSON API:
  • New coverage: Tester users
• Word reports:
  • Add CodeHighlight style support
• Add-on enhancements:
  • Nexpose: Add risk-score attribute to nodes
  • Nmap: Add port.service.tunnel field to the port template
  • Remediation tracker: tickets can be assigned to testers and contributors, and contributors can see their tickets too.

Not using Dradis Pro on your team?

These are some of the benefits you are missing out on:

• Automated reports, generate the same reports your clients know and love in a fraction of the time.
• Combine the output from 19+ different tools (including Qualys, Metasploit, Burp…) into a single report.
• Deliver consistent results. Never forget any steps, always know what has been covered and what is still ahead.
• Everyone on the same page: all information available across the team.
• Dradis Pro is reliable, up-to-date and with comes with a top-notch dedicated support team.

Read more about Dradis Pro’s time-saving features or what our users are saying.

Dradis Professional Edition is a collaboration and reporting tool for information security teams that will help you deliver the results of security assessments, in a fraction of the time without the time-wasting frustration of creating manual reports.

What’s new in Dradis Pro v3.3

Auto-Save

There are few things more frustrating than losing work in progress when your connection drops, browser crashes, or you close the wrong tab. Dradis now automatically saves your changes every few seconds to help avoid this problem. When you return to work, and auto-saved data is available, restore your work from the browser’s cached version.

Configuration Kits

Get started with Dradis Pro with a click of a button using kits. Use a Dradis kit to set up an instance tailored to your needs just by uploading a single file. A single kit zip file can quickly import and configure a project, report, issue, and evidence templates and properties, Rules Engine rules, methodologies, and sample projects. Admins can still tweak and configure Dradis manually; kits offer a simple way to jumpstart setup.

Azure DevOps / VSTS

Send any issue from a Dradis project to Azure DevOps (formerly Visual Studio Team Services / Team Foundation Server) to create a Work Item. Once sent, the Issue in Dradis displays the state of Work Item so you can keep track of remediation activities without leaving Dradis.

Ready to upgrade to v3.3?

Release Notes

• Fix column overflow on Issues / IssueLib entries table
• Allow report content management even without an RTP
• Fix content blocks sorting in the sidebar
• REST/JSON API:
  • Add-ons can inject Project attributes
  • BI custom fields included in Projects API endpoint
  • BI custom fields included in Teams API endpoint
  • Project Scheduler add-on includes :start and :end date in Projects endpoint
• Fix sorting for issues under nodes on export
• Add ability to upload configuration kits via web
• Add screenshot validator
• Projects are created with a background job
• Two-step Contributor login

Not using Dradis Pro on your team?

These are some of the benefits you are missing out on:

• Automated reports, generate the same reports your clients know and love in a fraction of the time.
• Combine the output from 19+ different tools (including Qualys, Metasploit, Burp…) into a single report.
• Deliver consistent results. Never forget any steps, always know what has been covered and what is still ahead.
• Everyone on the same page: all information available across the team.
• Dradis Pro is reliable, up-to-date and with comes with a top-notch dedicated support team.

Read more about Dradis Pro’s time-saving features or what our users are saying.

Dradis Professional Edition is a collaboration and reporting tool for information security teams that will help you deliver the results of security assessments, in a fraction of the time without the time-wasting frustration of creating manual reports.

What’s new in Dradis Pro v3.2

Here is Rachael with a quick video summary of what’s new in this release:

Integrated CVSSv3 Calculator

Quickly generate a CVSSv3 Risk score for an individual issue directly in Dradis. The CVSSv3 score calculator is now included as a tab on each issue for handy access. Edit the values on the calculator to populate the issue’s CVSSv3 details, including a valid vector string, with no need to copy and paste!

IssueLibrary ships with Dradis Pro⛵

Ever wish that the IssueLibrary wasn’t a separate installation and upgrade process from Dradis Pro? Wish no more! IssueLibrary is now bundled with Dradis Pro.

If you haven’t been using IssueLibrary, now is your pain-free opportunity to give it a spin. Cultivate a collection of your finest vulnerability descriptions to reuse across your Dradis Pro projects.

Already have vulnerability descriptions in another format outside of Dradis? Reach out to our support team and they can set you up to easily migrate them into IssueLibrary.

Upgrading from an earlier version of the IssueLibrary?
You must first remove IssueLibrary before applying the DUP by deleting the IssueLibrary line from /opt/dradispro/dradispro/current/Gemfile.plugins.

IssueLibrary API endpoints

The IssueLibrary is the newest API endpoint to be added to Dradis Pro. Use this new endpoint to create, update, retrieve and delete IssueLibrary entries. Check out the IssueLibrary API guide for examples to get started.

Ready to upgrade to v3.2?

Release Notes

• Use ajax in comments
• Fix nodes sidebar header margin
• Add bold font to improve bold text visibilit
• Fix links display in Textile fields
• Fix redirection destinations after edit/delete evidence
• Refactor cache keys in pages with comments
• Disable turbolinks cache when displaying flash messages
• Sort attachments in alphabetical ASCII order
• Fix methodology checklist edit error
• Add contributors and contributors management
• Add IssueLibrary to the main app – no manual upgrades!
• Fix export error caused by whitespace between newlines
• Fix auto-linking export error for non-latin characters, dashes, and parenthesis
• Fix multiple permissions added to a project when created via API
• Add default tags to new project templates
• Fix the bug that caused project to disappear when an author updates a project
• Add seeds for the rules engine
• Fix user count in teams list
• Add contributor management view hooks for the Teams and Users pages
• Allow deletion of teams with users
• Show project Custom Properties in Business Intelligence – Trend Analysis
• Fix XSS vulnerability when uploading svg attachments
• Fix XSS vulnerability when evidence were sent to Trash
• REST/JSON API:
  • New endpoint: IssueLibrary entries
• Add-on enhancements:
  • CVSS calculator: embed CVSSv3 calculator in Issue page
  • Acunetix: Resolve create_node errors that appeared with URLs wo/ “http”
  • Burp: Make `issue.detail` available at the Evidence level
  • Netsparker: Change alphabetical lists to bullet lists

Not using Dradis Pro on your team?

These are some of the benefits you are missing out on:

• Automated reports, generate the same reports your clients know and love in a fraction of the time.
• Combine the output from 19+ different tools (including Qualys, Metasploit, Burp…) into a single report.
• Deliver consistent results. Never forget any steps, always know what has been covered and what is still ahead.
• Everyone on the same page: all information available across the team.
• Dradis Pro is reliable, up-to-date and with comes with a top-notch dedicated support team.

Read more about Dradis Pro’s time-saving features or what our users are saying.

Dradis Professional Edition is a collaboration and reporting tool for information security teams that will help you create reports, in a fraction of the time.

For this release, we’ve squashed some pesky bugs and updated the system and its add-ons with new features that will make your team’s life easier.

The highlights of Dradis Pro v3.1

• Added comments, subscriptions and notifications to notes
• Added comments, subscriptions and notifications to evidence
• Added comments, subscriptions and notifications to methodology cards
• Pre-flight tool upload validator
• Fix default tags creation bug
• Allow numeric fields to be 0 when validating
• Fix BI engine load error (hook into model load and not ActiveRecord load)
• Fix overflow bug when editing report templates (issue sorting tab)
• Updated how add-ons hook into the main menu
• Fix error pages
• Renamed clients to teams in the backend
• Fix blockcode characters displaying incorrectly
• Fix red dot still being displayed on the first visit to the page that caused the single unread notification
• Fix wrong ‘There are no comments’ message
• Escape HTML in comments
• Track activities when multiple-creating evidence
• Fix BI custom project properties
• Better engine manifest hooks
• Keep lists and cards order when exporting as XML
• When errors found validating evidence, report with evidence id
• Add-on enhancements:
  • Note and evidence comments in export/import in dradis-projects
  • Fix usage of set_property to use set_service in Nexpose plugin
  • Netsparker: Update cleanup_html to format content + add new fields

Comments for methodology cards, evidence, and notes

Comments, notifications, and subscriptions introduced in Dradis v3.0 have been extended to include methodology cards, notes, and evidence in projects. You can leave a comment tagging another user, subscribe to be notified of comments and receive notifications for cards, notes, evidence, and issues. All comments are included during project import/export with dradis-project.

Checking for empty fields

Dradis will check for empty fields when saving a field required by your template and when validating your project before exporting a report. Catching and correcting these empty fields before generating your report will help prevent the dreaded ambiguous cell mapping Word error.

Pre-flight tool upload validator

While uploading output from a tool into a project, Dradis will check your Plugin Manager configuration against your report template configuration. If your template is configured to require a “Recommendations” field but no #[recommendation]# field is defined in the Plugin Manager for this output file type, Dradis will throw a warning.

Ready to upgrade to v3.1?

Not using Dradis Pro on your team?

These are some of the benefits you are missing out on:

• Automated reports, generate the same reports your clients know and love in a fraction of the time.
• Combine the output from 19+ different tools (including Qualys, Metasploit, Burp…) into a single report.
• Deliver consistent results. Never forget any steps, always know what has been covered and what is still ahead.
• Everyone on the same page: all information available across the team.
• Dradis Professional is reliable, up-to-date and with comes with quality support

Read more about Dradis Pro’s time-saving features or what our users are saying.