PwnDoc-ng Documentation

PwnDoc-ng is a pentest reporting application designed to simplify the process of writing findings and generating customizable Docx reports. It aims to reduce documentation time by allowing users to mutualize vulnerability data.

Key capabilities include:

• Vulnerability Management: Manage reusable audit and vulnerability data.
• Customization: Create custom sections and add custom fields to vulnerabilities.
• Multi-User Reporting: Support for collaborative reporting environments.
• Report Generation: Generate Docx reports based on customizable templates.
• Rich Text Editing: Uses Tiptap 2.0 WYSIWYG editor with support for tables, spellchecking, and syntax highlighting for various code types (css, js, http, ts, html, bash, sql, json).

PwnDoc-ng provides several key capabilities for penetration testing workflows:

• Vulnerability Management: Manage reusable vulnerability data and add custom fields to vulnerabilities.
• Audit Management: Manage reusable audit data and create custom sections.
• Report Generation: Generate .docx reports using customizable templates.
• Collaboration: Supports multi-user reporting and data sharing.
• Localization: Supports multiple languages and data formats.

Pwndoc-ng includes two default roles:

• user: A standard role with permissions to manage their own audits, vulnerabilities, clients, and companies. It has read access to templates, languages, audit types, vulnerability types, categories, sections, and custom fields, and settings:read-public access.
• admin: A superuser role with full access to all permissions (*).

Audit Types define the nature of an audit and allow you to set default parameters that are applied when a new audit is created. You can configure:

• Templates: Assign default Word templates for each configured Language.
• Sections: Automatically add specific Custom Sections to the audit upon creation.
• Hidden Sections: Hide built-in sections (such as Network or Findings) if they are not required for that specific audit type.

Example configuration:

• Name: Web Application
• Templates: [English Template, French Template]
• Sections: [Executive Summary, Nessus Scan]
• Hidden Sections: [Network]

PwnDoc-ng supports multi-user editing for Audits.

• Visibility: Users currently viewing an Audit are listed at the bottom of the Sections sidebar, showing which specific section they are currently editing.
• Concurrency Warning: If two users edit the same section simultaneously, the last user to click save will overwrite the previous changes. To avoid data loss, ensure collaborators are working on different sections.

Collaborators are users within Pwndoc-ng who participate in audits. They are assigned one of three roles which determine their access levels across Audits, Vulnerabilities, Companies, and Clients:

• user: Has Read/Write access to audits they created or are collaborating on, and Read/Write access to Companies and Clients. They have Read-only access to Vulnerabilities.
• report: Inherits all permissions from the user role and adds Read/Write access to all Audits.
• admin: Has Read/Write access to everything in the application.

To avoid duplicates and improve multi-language management, you can merge two different vulnerability entries that represent the same issue in different languages.

How Merging Works:

1. Select the two languages to compare.
2. The interface displays vulnerabilities that exist in one language but not the other (e.g., Left column: English AND NOT French; Right column: French AND NOT English).
3. When merged, the language details from the right column are moved into the vulnerability in the left column.
4. Data Retention: The core data from the left column (such as CVSS, references, etc.) is preserved and remains the primary record.

Pwndoc-NG uses a custom angular parser that supports the $index variable. This allows you to track the current position of an element within a loop, which is useful for conditional logic based on position or accessing parallel arrays.

Syntax: Use $index within a loop block to perform comparisons or to index into other lists.

{#names}
{#$index == 0}First item !{/}
{names[$index]}
{ages[$index]}
{/names}

Use standard Docker Compose commands to manage the development containers:

• View logs: Follow the live output from the containers to debug the application.
• Stop containers: Halt the running containers.
• Start containers: Resume stopped containers.

# Display container logs
docker-compose logs -f

# Stop containers
docker-compose stop

# Start containers
docker-compose start