← retour aux outils back to tools

# DefectDojo

Plateforme OWASP de gestion des vulnérabilités et de reporting de pentest qui agrège les sorties de scanners et suit les findings à travers les missions et les produits. OWASP vulnerability management and pentest reporting platform that aggregates scanner output and tracks findings across engagements and products.

↗ https://github.com/DefectDojo/django-DefectDojo

## Overview

DefectDojo is an open-source (OWASP flagship) application vulnerability management platform. Pentesters and AppSec teams use it to import results from dozens of scanners (Nmap, Burp, Nessus, ZAP, Nikto, Trivy, etc.), deduplicate findings, track remediation, and generate reports across products, engagements, and test cycles.

## Common Usage

    # Run DefectDojo locally via Docker Compose
    git clone https://github.com/DefectDojo/django-DefectDojo
    cd django-DefectDojo
    docker compose up -d

Import a scan result via the REST API

    curl -X POST "https://<dojo-host>/api/v2/import-scan/" \
      -H "Authorization: Token <api-key>" \
      -F "scan_type=Nmap Scan" \
      -F "file=@nmap-results.xml" \
      -F "engagement=12"

Re-import to update an existing set of findings (dedup/merge)

    curl -X POST "https://<dojo-host>/api/v2/reimport-scan/" \
      -H "Authorization: Token <api-key>" \
      -F "scan_type=Burp Scan" \
      -F "file=@burp-results.xml" \
      -F "test=45"

List findings via API

    curl -H "Authorization: Token <api-key>" \
      "https://<dojo-host>/api/v2/findings/?active=true&severity=Critical"

## Notes

- Supports 100+ scanner import formats out of the box (Nmap, Nessus, Qualys, Burp, ZAP, Semgrep, Trivy, Gitleaks, etc.)
- Organizes work as Products → Engagements → Tests → Findings, matching typical pentest/AppSec program structure
- Has deduplication logic to merge repeat findings across re-imports/re-scans, useful for tracking remediation over time
- Reporting module generates client-ready PDF/Word reports directly from tracked findings

Help / Man page

    DefectDojo is a Django web application — no traditional CLI/man page.

    Local setup:
      docker compose up -d
      Default UI: http://localhost:8080

    REST API (v2):
      POST /api/v2/import-scan/     import a new scan's findings
      POST /api/v2/reimport-scan/   re-import into an existing test (dedup)
      GET  /api/v2/findings/        list/query findings
      GET  /api/v2/engagements/     list engagements
      GET  /api/v2/products/        list products

    Auth:
      Header: Authorization: Token <api-key>
      API key found under: User Profile → API v2 Key

## Vue d’ensemble

DefectDojo est une plateforme open source (produit phare de l’OWASP) de gestion des vulnérabilités applicatives. Les pentesters et les équipes AppSec l’utilisent pour importer les résultats de dizaines de scanners (Nmap, Burp, Nessus, ZAP, Nikto, Trivy, etc.), dédupliquer les findings, suivre la remédiation, et générer des rapports à travers les produits, les missions et les cycles de test.

## Utilisation courante

    # Lancer DefectDojo en local via Docker Compose
    git clone https://github.com/DefectDojo/django-DefectDojo
    cd django-DefectDojo
    docker compose up -d

    # Importer le résultat d'un scan via l'API REST
    curl -X POST "https://<dojo-host>/api/v2/import-scan/" \
      -H "Authorization: Token <api-key>" \
      -F "scan_type=Nmap Scan" \
      -F "file=@nmap-results.xml" \
      -F "engagement=12"

    # Réimporter pour mettre à jour un ensemble de findings existant (dédup/fusion)
    curl -X POST "https://<dojo-host>/api/v2/reimport-scan/" \
      -H "Authorization: Token <api-key>" \
      -F "scan_type=Burp Scan" \
      -F "file=@burp-results.xml" \
      -F "test=45"

    # Lister les findings via l'API
    curl -H "Authorization: Token <api-key>" \
      "https://<dojo-host>/api/v2/findings/?active=true&severity=Critical"

## Notes

- Supporte 100+ formats d’import de scanners d’origine (Nmap, Nessus, Qualys, Burp, ZAP, Semgrep, Trivy, Gitleaks, etc.)
- Organise le travail en Products → Engagements → Tests → Findings, ce qui colle à la structure typique d’un programme pentest/AppSec
- Dispose d’une logique de déduplication pour fusionner les findings répétés entre réimports/réscans, utile pour suivre la remédiation dans le temps
- Le module de reporting génère des rapports PDF/Word prêts pour le client directement à partir des findings suivis

Aide / Page de manuel

    DefectDojo is a Django web application — no traditional CLI/man page.

    Local setup:
      docker compose up -d
      Default UI: http://localhost:8080

    REST API (v2):
      POST /api/v2/import-scan/     import a new scan's findings
      POST /api/v2/reimport-scan/   re-import into an existing test (dedup)
      GET  /api/v2/findings/        list/query findings
      GET  /api/v2/engagements/     list engagements
      GET  /api/v2/products/        list products

    Auth:
      Header: Authorization: Token <api-key>
      API key found under: User Profile → API v2 Key