I would like to hear from you which tools (commercial and open source) do you use to share results during collaborative penetration test or source code/binary analysis. Well-known Dradis framework helps at some level, but it would be nice to see other possible solutions, methodologies how teams work and exchange their results effectively.
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Jens Erat, Xander, Bob Brown, AviD
HP AMP and HP Fortify 360. HoneyApps Conduit. Denim Group Vulnerability Manager, Veracode, Aspect Security ARMS.
Atlassian Crucible, Friendpaste, SyntaxHighlighter, Smartbear Software CodeCollaborator
With my current client I am using HP Fortify 360 as the central repository for sharing results to multiple teams in Development, Security Audit and Project Management.
All the development project build scripts can automatically upload results into 360, where a per project template is applied, the team can review issues and apply outcomes.
All issues are tracked over time - so their defect management system can effectivelydisplay results to management.
The reporting functionality includes technical detail on issues and recommendations for the development team, as well as high level stats for senior management.
Same as every tool, it has issues, however the management framework is pretty good, and for that reason it gets a thumbs up from me.
You should give a try a https://github.com/infobyte/faraday it's a open source project. We use it to track and share all the information during a pentest