I would like to hear from you which tools (commercial and open source) do you use to share results during collaborative penetration test or source code/binary analysis. Well-known Dradis framework helps at some level, but it would be nice to see other possible solutions, methodologies how teams work and exchange their results effectively.

closed as off-topic by Jens Erat, Xander, Bob Brown, AviD Apr 25 '15 at 21:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.


HP AMP and HP Fortify 360. HoneyApps Conduit. Denim Group Vulnerability Manager, Veracode, Aspect Security ARMS.

Atlassian Crucible, Friendpaste, SyntaxHighlighter, Smartbear Software CodeCollaborator

  • Good list, but except of that, it would be nice to hear something from personal experience - your opinion, maybe slight comparison, etc. (This note refers also to all others who would like to reply.) – anonymous Nov 20 '10 at 11:23
  • A lot of these are automated tools to find issues, but add very little in the way of sharing the results. – AviD Nov 21 '10 at 12:52
  • @AviD: No, absolutely not. All of the tools I mentioned are for sharing the results. Perhaps I should mention that Veracode's offering is a risk management portal to submit appsec issues to, for sharing purposes, as a result of external pen-testes, code reviews, or their own Veracode services. – atdre Nov 22 '10 at 0:52
  • As far as i used HP Fortify, it is not a penetration testing tools rather it is a code scanner. The HP Fortify 360 is an administration control to report analyze every discovered vulnerability and to report false positives etc... I wouldn't call it sharing. I mean of course others can see the results and work on them but there is no mean to interact with chatting, or collaboration rooms etc... That's my 2 cent's – Phoenician-Eagle Mar 31 '11 at 19:12

With my current client I am using HP Fortify 360 as the central repository for sharing results to multiple teams in Development, Security Audit and Project Management.

All the development project build scripts can automatically upload results into 360, where a per project template is applied, the team can review issues and apply outcomes.

All issues are tracked over time - so their defect management system can effectivelydisplay results to management.

The reporting functionality includes technical detail on issues and recommendations for the development team, as well as high level stats for senior management.

Same as every tool, it has issues, however the management framework is pretty good, and for that reason it gets a thumbs up from me.


You should give a try a https://github.com/infobyte/faraday it's a open source project. We use it to track and share all the information during a pentest

  • Not sure why this is getting downvoted.. it's a legitimate suggestion. – Glenn 'devalias' Feb 8 '17 at 2:24