Pandemic or New Year – AttackForge Release Must Go On!
Happy New Year and Happy New Release! This one is definitely big and full of great stuff!
Custom Vulnerability Libraries – to make sure that your vulnerability write-ups are easy to manage and control
Second generation of AttackForge famous ReportGen tool, completely redesigned internals with support for WYSIWYG for your Steps to Reproduce, new filters and a brand-new interface!
Introduction of endpoints to Assets – making tracking and remediation of vulnerabilities more granular and visible.
More integrated support for custom fields and tags across AttackForge, easier management of test cases and vulnerabilities.
Configurable data tables and other significant UX improvements.
New configuration options to have your AttackForge tenant the way your organisation would want it.
And – as always - updates to Self-Service API.
Custom Vulnerability Libraries
In the last release, AttackForge introduced the concept of multiple vulnerability libraries - and our customers loved it and asked for more. So, our engineers introduced a concept of fully configurable and access-controlled custom vulnerability libraries.
Now you can setup custom vulnerability libraries and apply proper access controls to those libraries!
There are multiple use cases for custom vulnerability libraries. Here are few of them:
Have different libraries for different security teams:
Red Team,
Application Security Team,
Infrastructure Security Team,
Architecture Review Team
All of them would be able to build and use specialized libraries of vulnerabilities – making it easier to navigate and use.
Different security vendors (pentesting providers)
Your organisation might use different pentesting providers. With custom vulnerability libraries they would be able to operate using their own write-up libraries – if your organisation would want that.
Dedicated libraries for highly specialized pentesting activities
Specialised pentesting such as hardware hacking, or social engineering assessments usually have specific write-ups. Custom libraries would allow you to keep them separate and access controlled.
Platform specific libraries
Specific platforms or technologies, such as Windows, Linux, REST API, etc. could have their own libraries helping with consistency.
ReportGen v2 Released
AttackForge has the best-of-breed reporting engine. And in this release, our engineers made it better and even easier to use.
The challenge with all automated reporting tools is to make it easy to use – so users would not need to learn a new language or pay for professional services to build their templates. AttackForge achieved this.
In this major update, we managed to further simplify the internal reporting engine to improve performance and work more efficiently even with huge reports (many thousands of pages).
AttackForge also comes with a standalone offline tool that has also been redesigned with a new user interface, including direct access to our extensive training materials, templates library, troubleshooting guides as well as advanced error handling for testing your templates.
Our engineers introduced WYSIWYG editor for Proof of Concept/Steps to Reproduce and now it is supported by AttackForge ReportGen. If you want to take advantage of this functionality in your templates please replace the following tags: {#proof_of_concept}{text}{%inlineScreenshot}{/proof_of_concept} with the following: {@proof_of_concept_styled}
New filters hasAny and hasAll allows our customers to create logic gates within reports.
Several new tags are added so you can make even more advanced reports.
Tracking Affected Endpoints
It is a common situation when a pentester needs to record the same vulnerability for the same asset, but for different endpoints. There are multiple examples of it – it could be:
Multiple vulnerable ports on the same host or IP address
Multiple vulnerable HTTP parameters on the same web application or API
Multiple vulnerable lines of code in a source code file
Multiple vulnerable components within all assets
Each vulnerable endpoint has to be tracked and remediated. At the same time, it is not practical to track each endpoint as a separate asset.
AttackForge introduced the concept of affected endpoint in addition to the affected asset which is already available.
This allows you to have tracking per-asset as well as per-endpoint within AttackForge interface and in the reports.
This functionality can be enabled by your Admins via the Configuration module. Step-by-step guide on how to enable it (as always) can be found on our support site:
Customizable project vulnerabilities table
Users can now set up their own default view for the vulnerability table to adjust the default options for:
Results per page
Default column to sort on
Default column sort order
Toggle visibility for each column
Toggle position for each visible column
As always - updates to Self Service API
New REST and Events APIs, updates to existing APIs (with backward compatibility of course!) – to help clients with the integration of AttackForge into their Enterprise ecosystem.
Other Functionality
New configuration options for your AttackForge tenant
Set up order for your pentesting methodologies - test suites and individual test cases
This allows you to control the order in which test cases on a project are presented to users.
New tags & sections for daily status update emails
Significant number of new tags which can be referenced in daily status update emails.
Update custom fields on projects and vulnerabilities
You can now update or delete any arbitrary custom fields created on your projects and vulnerabilities. These are custom fields which you may have imported from other tools or scripts.
Bulk update for selected fields for multiple vulnerabilities
Bulk delete for test cases on test suites
And many other improvements and new functionality – check our Release Notes here.