Skip to content

Commit 17b3005

Browse files
summittsummitt
committed
1.6 updates
1 parent 503d1ee commit 17b3005

120 files changed

Lines changed: 16442 additions & 2338 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

docs/Integrate Faction into OIDC Solutions.md renamed to docs/Authentication/Integrate Faction into OIDC Solutions.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,4 +87,11 @@ Your Setup should look like the following:
8787

8888
![](files/Pasted%20image%2020231218082756.png)
8989

90-
When the new user reaches the Login Screen they can enter just their username without a password and click **Login**. Faction will redirect the user to the configured Authentication Provider and redirect back.
90+
When the new user reaches the Login Screen they can enter just their username without a password and click **Login**. Faction will redirect the user to the configured Authentication Provider and redirect back.
91+
92+
## Custom SignOn URLS
93+
You can bypass the username and password form by bookmarking the below URL. This ensures you don't need to enter a Username just to be redirected to your SSO portal where the user needs to enter their Username again. The below URL will redirect directly to your configured SSO portal for ODIC.
94+
95+
```
96+
https://YOURHOST/sso/oauth
97+
```

‎docs/Authentication/SAML MS Entra ID Configuration.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
---
2+
tags: [Authentication, Core Features]
3+
date: 2025-05-28
4+
---
5+
## Overview
6+
This tutorial will walk you through the steps required to set up Faction with your Microsoft Entra ID Single Sign On using SAML
7+
8+
## Configuring Entra ID in Azure
9+
10+
1. Open the Azure Console and navigate to "Entra Id"
11+
![](/files/Pasted%20image%2020250528231939.png)
12+
2. Navigate to Enterprise Applications:
13+
3. Click "New Application"
14+
4. Click "Create your own application."
15+
5. Enter a name (i.e Faction SAML) and select "Integrate any other application you don't find in the gallery (Non-gallery)" radio button.
16+
6. Click Manage->"Single Sign On", then select SAML
17+
![](/files/Pasted%20image%2020250528232758.png)
18+
7. Click 'Edit' under "Basic SAML Configuration"
19+
8. Under Identifier (Entity ID) enter the following URLs:
20+
- `https://yourfactionurl.com/saml2/callback?client_name=SAMLClient`
21+
- `https://yourfactionurl.com/saml2/callback`
22+
1. Under "Reply URL (Assertion Consumer Service URL)" add the following reply url:
23+
- `https://yourfactionurl.com/saml2/callback?client_name=SAMLClient`
24+
- `https://yourfactionurl.com/saml2/callback`
25+
1. If your config looks like the image below, then click 'Save'
26+
![](/files/Pasted%20image%2020250529222514.png)
27+
2. Now navigate to "Single Sign On" and copy the "App Federation Metadata Url". This will be used in the next section.
28+
![](/files/Pasted%20image%2020250529083833.png)
29+
30+
## Finish Configuration in FACTION
31+
With the Federation URL copied, you are now ready to finish the configuration on the Faction side.
32+
1. Log in to Faction as an admin
33+
2. Navigate to Administration->Users
34+
3. Scroll to the bottom and enter the URL we copied from step 11 above into "App Federation Metadata Url" input box.
35+
4. Click Save
36+
37+
## Configure a User for SAML Authentication
38+
1. Log in to Faction as admin
39+
2. Navigate to Administration->Users
40+
3. Click Add User
41+
4. Set the following parameters:
42+
- Set username to the first part of the email address.
43+
- Enter the first and last name of the user
44+
- Leave the password blank
45+
- Set the email address. It MUST match the email address of the user managed in Entra ID
46+
- Set the "Authentication Method" to SAML2
47+
![](/files/Pasted%20image%2020250529222945.png)
48+
1. Click Save
49+
50+
## Login with SAML
51+
SAML users only need to enter their username and submit login. Faction will automatically redirect the user to SSO login form.
52+
53+
## Custom SignOn URLS
54+
You can bypass the username and password form by bookmarking the below URL. This ensures you don't need to enter a Username just to be redirected to your SSO portal where the user needs to enter their Username again. The below URL will redirect directly to your configured SSO portal for SAML.
55+
56+
```
57+
https://YOURHOST/sso/saml
58+
```
59+

‎docs/Faction App Store Extensions.md‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,20 @@ weight: 1
55
---
66

77

8-
Below is a List of Approved Faction Extensions. These all work with Faction 1.2+
8+
List of Approved Faction Apps
99

1010
| Name | Developer | URL |
1111
| --- | --- | --- |
12-
| Faction Jira Integration | Faction Security | [https://github.com/factionsecurity/Faction-Jira-Extension](https://github.com/factionsecurity/Faction-Jira-Extension) |
13-
| Faction Vulnerability Bar Chart | Faction Security | [https://github.com/factionsecurity/Faction-Vulnerability-Bar-Chart](https://github.com/factionsecurity/Faction-Vulnerability-Bar-Chart) |
12+
| Faction Jira Integration | Faction Security | https://github.com/factionsecurity/Faction-Jira-Extension |
13+
| Faction Vulnerability Bar Chart | Faction Security | https://github.com/factionsecurity/Faction-Vulnerability-Bar-Chart |
14+
| Faction Checklist Reporting | Faction Security | https://github.com/factionsecurity/checklist-report-extension/releases |
15+
16+
17+
## Info on Building a Faction Extension
18+
- [App Store Extension API](https://docs.factionsecurity.com/APIS/App%20Store%20Extension%20API)
19+
- [JIRA Example](https://docs.factionsecurity.com/APIS/JIRA%20App%20Integration%20Example)
20+
21+
## Submit an Extension
22+
Send an email to develop [ at ] factionsecurity [dot] com with a link to to your github and a brief explanation of what it does.
1423

1524

16-
# Submit an Extension
17-
Send an email to develop [ at ] factionsecurity [dot] com with a link to your github and a brief explanation of what it does.

docs/Managed FACTION Setup.md renamed to docs/Hosting/Managed FACTION Setup.md

File renamed without changes.

docs/Self-Hosted FACTION Setup.md renamed to docs/Hosting/Self-Hosted FACTION Setup.md

File renamed without changes.

‎docs/Reporting/Assessment Checklists.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
tags: [Reporting, Customize, Variables, Checklists, Assessments, Extensions, App Store]
3+
date: 2025-07-08
4+
---
5+
6+
### Overview
7+
When conducting frequent penetration tests, having assessment-specific checklists that all assessors follow and document is critical for ensuring consistency, thoroughness, and accountability. These checklists act as structured guides that standardize testing procedures, helping teams avoid oversights and maintain coverage across all critical areas of an environment. Without them, even experienced assessors may miss essential steps due to time constraints, complexity, or assumptions about low-risk areas. A well-maintained checklist also ensures that repeatable methodologies are applied across engagements, making results more reliable and easier to compare over time.
8+
9+
Additionally, documented checklists provide transparency for clients and stakeholders by showing exactly what was tested and how. This supports compliance requirements, helps justify findings, and allows for more meaningful remediation planning. In team environments, it also facilitates knowledge sharing, onboarding of new assessors, and quality assurance reviews. Ultimately, standardized checklists are a foundational practice for delivering high-quality, trustworthy, and defensible penetration testing services.
10+
11+
Faction includes built-in support for Checklists in both the Open Source and Enterprise versions. You can create and manage as many checklists as needed—such as OWASP Top 10, Mobile Assessment Checks, or Network Assessment Tests. Once added, these checklists can be enforced as part of your assessments and even integrated into Peer Reviews. This provides an excellent way to ensure that assessments remain consistent, thorough, and aligned with best practices.
12+
13+
## Adding a Checklist
14+
In this example we will an OWASP Top 10 Checklist.
15+
16+
1. Navigate to Admin->Checklists
17+
2. Click **Create new checklist**
18+
3. Start adding items to the checklist.
19+
4. Ensure you check the Assessment Type at the bottom under **Required For**. This ensures checklists are assessment specific.
20+
![](/files/Pasted%20image%2020250708014034.png)
21+
22+
## Filling Out Checklists in Assessments
23+
There is a **Checklists** tab in *Assessments*. The assessor will need to add checklists that are required for this assessment type. ***The assessment cannot be finalized until all checklist items are validated. ***
24+
![](/files/Pasted%20image%2020250708014420.png)
25+
26+
## Adding Checklists to Reports (Optional)
27+
In addition to making it a sanity check for your assessments you can choose to add certain checklist to your generated reports using one of our App Store Extensions.
28+
29+
### Enable the CheckList Extension
30+
Follow these steps to add a checklist to your assessment.
31+
32+
1. Download the [CheckList Extension here](https://github.com/factionsecurity/checklist-report-extension/releases)
33+
2. Navigate to Admin->AppStore
34+
3. Click **Install Extension** from the upper right
35+
4. Upload faction-report-checklist-X.X.jar
36+
5. Click Install
37+
6. Back on the Installed Extensions table switch the extension to **On**
38+
![](/files/Pasted%20image%2020250708012904.png)
39+
40+
### Update The Report Template
41+
Checklists can be added anywhere to your report using variable names. The variable name is based on the title of your checklist. For instance if you created a checklist named ***OWASP TOP 10***, then the variable name will be `${checklist-owasp-top-10}`.
42+
43+
![](/files/Pasted%20image%2020250708015655.png)
44+
45+
Once the report template is updated, the report can be generated from the **Finalize** tab in the assessment. The default result will look like the following:
46+
47+
![](/files/Pasted%20image%2020250708015518.png)
48+
49+
### Customizing the CheckList Extension Output
50+
The Checklist Extension has several configureable options. You can change text thats printed on Pass, Fail, or N/A status. You can also change the background and foreground colors.
51+
52+
To configure the extension, navigate to Admin->App Store and select the Checklist Extension. There are options at the bottom of the screen.
53+
54+
![](/files/Pasted%20image%2020250708020140.png)
55+
56+
57+
58+
59+
60+
61+

docs/Custom Security Report Templates.md renamed to docs/Reporting/Custom Security Report Templates.md

File renamed without changes.

docs/Custom Variables.md renamed to docs/Reporting/Custom Variables.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
tags: [Reporting, Customize]
2+
tags: [Reporting, Customize, Variables]
33
date: 2024-02-12
44
---
55

docs/Importing Your Vulnerability Templates Via the API.md renamed to docs/Reporting/Importing Your Vulnerability Templates Via the API.md

File renamed without changes.

‎docs/Reporting/Rich Text Custom Variables.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
tags: [ Reporting, Enterprise, Paid Feature, Managed, Variables]
3+
date: 2025-07-07
4+
---
5+
!!! note
6+
This is an Enterprise Only Feature
7+
8+
In the open source version, rich text support is limited to two predefined sections: **Executive Summary** and **Risk Assessment**. The Enterprise edition introduces **Rich Text Custom Variables**, allowing you to define additional rich text sections within your reports. This gives you significantly more flexibility and control over report structure and presentation, beyond the default sections.
9+
10+
The following tutorial shows you how to add these to your reports.
11+
12+
### Create the Custom Variable
13+
1. Navigate to Admin->Settings
14+
2. Enter a title into the **Field Name Display**
15+
3. Enter a variable name ***WITHOUT SPACES***
16+
4. Select **RichText** from the **DataType**
17+
5. Choose where this field is applicable (Assessment or Vulnerability)
18+
19+
In this Example we will create a custom Scoping Field that we can add anywhere in the report.
20+
![](/files/Pasted%20image%2020250707235330.png)
21+
22+
### (Optional) Create Boiler Plate text
23+
You can create a default text to be easily recalled into any of these custom variables. In this example we will continue with adding a template for Scope:
24+
25+
1. Navigate to Templates->Assessment Templates
26+
![](/files/Pasted%20image%2020250707235828.png)
27+
2. Select the newly created Template and any custom text:
28+
```
29+
The scope included the ${asmtName}  site’s test environment with the most current version at the time of testing. The testing started ${asmtStart} and ended on ${asmtEnd}. The testing was performed against this site in order to cause minimal disruptions to the production site.
30+
31+
| @cols=2:Assessment Scope |
32+
| ------------ | --------- |
33+
| **QA Main URL** | |
34+
| **Subdomains In Scope**| |
35+
36+
```
37+
![](/files/Pasted%20image%2020250708001457.png)
38+
3. Save the Template
39+
40+
### Update the Report Template
41+
1. Take the your report template and add a new section. In this example we will add a Scope Section.
42+
2. Enter the variable name `${cfAssessmentScope}`. This variable is text entered in Step3 above and prepended with `cf` for Custom Field.
43+
![](/files/Pasted%20image%2020250708001840.png)
44+
3. Upload your report Template ( Templates->Report Designer )
45+
46+
### Editing Rich Text Variables in Assessments and Vulnerabilities
47+
Once the field is added it will show up on the next assessment thats created. Double click *Assessment Scope* in the templates options on the far right. This will add our boiler plate text (optional step above) to the report.
48+
![](/files/Pasted%20image%2020250708003445.png)
49+
50+
!!! note
51+
If you have an existing assessment assigned to an assessor before the field is created then the new field will not be visible until you resave the assessment.
52+
If the user has permissions then they will see a *Edit* button in the title of the assessment. This will open the assessment in **Scheduling** and allow you to resave it.
53+
Otherwise you will need someone with **Scheduling** permissions find it and resave it.
54+
*You don't need to make any changes to the assessment. Just save it. *
55+
56+
57+
Now you can generate the report (Assessment->Finalize->Generate Report). This will build the report with our new custom variables populated.
58+
59+
![](/files/Pasted%20image%2020250708004052.png)
60+
61+
62+
### Advanced Formatting
63+
You can further enhance the appearance of your report by editing the CSS in the **Report Designer**. This allows you to apply custom styles specifically to this custom variable without affecting the global report template.
64+
65+
!!! note
66+
The name of the custom variable is used as a CSS class. All content entered in the Rich Text Editor is automatically wrapped in a `<div>` with that class name, for example: `<div class="VariableName">Rich Text Content Here</div>`.
67+
68+
69+
Continuing with our example of adding a Scope section, follow these steps to add custom style to the Scope Table so that the header matches our theme:
70+
71+
1. Navigate to Templates->Report Designer
72+
2. Click **Edit CSS**
73+
3. Append the following CSS to the form. **Note AssessmentScope as the class name**
74+
```
75+
.AssessmentScope th {
76+
height: 40px;
77+
text-align: center;
78+
color: white;
79+
background-color: #04A4EB;
80+
}
81+
```
82+
83+
![](/files/Pasted%20image%2020250708005218.png)
84+
4. Save it
85+
5. Regenerate your report
86+
87+
![](/files/Pasted%20image%2020250708005351.png)
88+
89+
90+
91+
92+

0 commit comments

Comments
 (0)