Welcome to Logos Red, I go bylogos and:
Over the last few days, I was looking at ways to streamline my penetration testing reporting.
After enough searching, I found two free, open-source reporting tools: Ghostwriter and SysReptor.
I chose Ghostwriter, and in this post I will detail the choice I made.
My Promise
This post will finally end your meaningless search for a valid answer, and you will leave with a choice made.
If there are still any questions left, let me know so I can add it to help the next person who will arrive here.
My Goal
To help you improve in less time than it took me and to make sure you leave with what I promised.
I want you to join our community and for this to be a place you come back to often.
What is Ghostwriter?
Ghostwriter is a web-based UI tool for managing clients, projects, and reports. It encompasses everything into one utility that can be either hosted locally or in the cloud.
Which makes it more than a simple reporting tool since it has multiple management features.
Specter Ops, the team behind projects such as Bloodhound, created it for their own use. They share the project for free on GitHub, making it accessible to anyone.
Ghostwriter Links:
Ghostwriter pros:
1. It is completely free.
Currently, there is no paid version of Ghostwriter available, with no sales involved.
You do not lose any functionality by using a free product.
2. SpecterOps developed it for their own use, not for sale
When it comes to any great pentest tool, look for the ones made by the creators to fix an issue they had.
Those tools were made to fix a pain that they experienced on a daily basis, the scope was purpose, not money.
3. Ease of setup
From every single tool I’ve used, Ghostwriter was the only one that worked with no issues at all.
If you have Docker installed, you can deploy the whole application using three commands, regardless of the platform.
Ghostwriter cons:
1. Complicated to use at first
While the setup is easy, mastering Ghostwriter will take some time to accomplish.
By clicking around you’ll notice that there are a lot of available features to choose from, which is an upside and a downside depending on your use case.
2. There are no report templates
No matter how much you’ll search around, you’re forced to build your own template.
Ghostwriter is a small project, there aren’t any public templates given out, and as such you must adapt and build your own.
3. Jinja2 template syntax
Ghostwriter uses Jinja2 to build templates out.
This post explains what Jinja2 is if you need to know, it looks harder than it is trust me.
While it does take some learning once you get used to it, it becomes an asset, there is an example report given that will help you understand.
4. You’ll need to get good at Word
Due to the Jinja2 syntax, you are forced to work in Microsoft Word.
Everything you design in your report will be done with Word, from creating tables to modifying styles.
So there will be a learning curve in understanding it fully, but once you do it becomes an asset.
Although I recommend everyone to use Linux, Jinja2 does not work as intended with LibreOffice, and you will face linting issues.
What is SysReptor?
SysReptor is also a web-based UI tool, the main difference being that SysReptor focuses on reporting only.
Syslifters the team behind SysReptor created the tool for their own use and also share the tool for free on GitHub with the addition of a paid version.
SysReptor links:
SysReptor pros:
1. Ease of use
Once you set up SysReptor, using it is flawless, as there aren’t many features to disturb you.
This can be an asset or a liability depending on your use case, but if you’re looking for a simple reporting tool, this might be it.
2. There are plenty of report templates available
You can get started reporting with SysReptor almost immediately, as there are plenty of templates to choose from.
From Offsec templates to HTB templates
The templates are plug and play, and you can immediately get started writing with no downtime for designing a template.
3. Editing in HTML and CSS
Compared to Jinja2 more people will have come across HTML and CSS.
You can do all the editing within the browser. There is no need for an external app. You can easily swap the initial demo for a solid report template.
4. Focuses on reporting only
If your team already has a management tool, a place where you store all client information, scope, and messages, then SysReptor is an ally.
If you only need a reporting tool specifically, then SysReptor is exactly that and only that.
SysReptor Cons:
1. Free version limits you to three users
Unfortunately, you are faced with a discrepancy between the free version and the paid version.
This means that if your team ever grows beyond three members, you are forced to pay, which is not necessarily a negative outcome.
While I agree with a free open-source project, if the team isn’t being funded, somehow they need to escape monetary constraints.
2. There is no concurrent editing in the free version
This means that you aren’t able to have multiple people working on the same section of a report, which might lead to issues.
3. Focuses on reporting only
I’ve put this down as both a pro and con because it depends on your circumstances.
If you already have a team management tool and for you it’s sufficient, then by all means choose SysReptor.
But if the need comes to have an ecosystem where everything is integrated into one, it might not be enough.
Why I chose Ghostwriter over SysReptor
While in this post it might seem as though the choice was obvious for me, I was really close to choosing SysReptor.
But eventually I realized that I needed something more, an ecosystem to include everything that I gather.
So these are the points that made me choose Ghostwriter:
1. It includes everything into one ecosystem
I personally wanted an application that included everything about my penetration testing reports in one single place.
I didn’t want to struggle between switching to multiple apps to find client data, the scope, targets, and what my team is doing.
2. Jinja2 is daunting at first, but afterwards it becomes an asset
Personalizing my template was a chore in the beginning until I got my Word skills back on track, but honestly, it will help you in the long run.
You get instant feedback on your actions. You can personalize everything as you wish. The only part related to Ghostwriter is styles and Jinja2 variables.
3. I was more familiar with SpecterOps
I believed more in the idea of Ghostwriter because I knew the team behind it.
From projects such as Bloodhound, I knew their reputation, and I knew that they used this software for their own use.
The team has a history, and as long as they are around, the project will continue to get updated and will most likely remain free.
Conclusion
In the end, it truthfully depends on what your use case is, both apps are solid, and they both offer exactly what they advertise, the main difference being:
If you want to get started immediately with Ghostwriter, you will need to learn Word and Jinja2 syntax as there are no templates, with SysReptor you can get started immediately.
If you need a tool focused on reporting only, choose SysReptor as Ghostwriter is more of an ecosystem that includes everything.
If your team includes more than three people, you will need to pay for SysReptor, with Ghostwriter there only exists a free version.
More Resources
If you didn’t understand something or you need some help, we have our own Discord community and I currently offer free coaching.
You can also leave us some feedback with what you did not understand and we will make sure to correct it.
