retour aux outils back to tools Ducklings

DefectDojo

Plateforme OWASP de gestion des vulnérabilités et de reporting de pentest qui agrège les sorties de scanners et suit les findings à travers les missions et les produits. OWASP vulnerability management and pentest reporting platform that aggregates scanner output and tracks findings across engagements and products.

↗ https://github.com/DefectDojo/django-DefectDojo

Overview

DefectDojo is an open-source (OWASP flagship) application vulnerability management platform. Pentesters and AppSec teams use it to import results from dozens of scanners (Nmap, Burp, Nessus, ZAP, Nikto, Trivy, etc.), deduplicate findings, track remediation, and generate reports across products, engagements, and test cycles.

Common Usage

# Run DefectDojo locally via Docker Compose
git clone https://github.com/DefectDojo/django-DefectDojo
cd django-DefectDojo
docker compose up -d

Import a scan result via the REST API

curl -X POST "https://<dojo-host>/api/v2/import-scan/" \
  -H "Authorization: Token <api-key>" \
  -F "scan_type=Nmap Scan" \
  -F "file=@nmap-results.xml" \
  -F "engagement=12"

Re-import to update an existing set of findings (dedup/merge)

curl -X POST "https://<dojo-host>/api/v2/reimport-scan/" \
  -H "Authorization: Token <api-key>" \
  -F "scan_type=Burp Scan" \
  -F "file=@burp-results.xml" \
  -F "test=45"

List findings via API

curl -H "Authorization: Token <api-key>" \
  "https://<dojo-host>/api/v2/findings/?active=true&severity=Critical"

Notes

  • Supports 100+ scanner import formats out of the box (Nmap, Nessus, Qualys, Burp, ZAP, Semgrep, Trivy, Gitleaks, etc.)
  • Organizes work as Products → Engagements → Tests → Findings, matching typical pentest/AppSec program structure
  • Has deduplication logic to merge repeat findings across re-imports/re-scans, useful for tracking remediation over time
  • Reporting module generates client-ready PDF/Word reports directly from tracked findings
Help / Man page 
DefectDojo is a Django web application — no traditional CLI/man page.

Local setup:
  docker compose up -d
  Default UI: http://localhost:8080

REST API (v2):
  POST /api/v2/import-scan/     import a new scan's findings
  POST /api/v2/reimport-scan/   re-import into an existing test (dedup)
  GET  /api/v2/findings/        list/query findings
  GET  /api/v2/engagements/     list engagements
  GET  /api/v2/products/        list products

Auth:
  Header: Authorization: Token <api-key>
  API key found under: User Profile → API v2 Key

Vue d’ensemble

DefectDojo est une plateforme open source (produit phare de l’OWASP) de gestion des vulnérabilités applicatives. Les pentesters et les équipes AppSec l’utilisent pour importer les résultats de dizaines de scanners (Nmap, Burp, Nessus, ZAP, Nikto, Trivy, etc.), dédupliquer les findings, suivre la remédiation, et générer des rapports à travers les produits, les missions et les cycles de test.

Utilisation courante

# Lancer DefectDojo en local via Docker Compose
git clone https://github.com/DefectDojo/django-DefectDojo
cd django-DefectDojo
docker compose up -d
# Importer le résultat d'un scan via l'API REST
curl -X POST "https://<dojo-host>/api/v2/import-scan/" \
  -H "Authorization: Token <api-key>" \
  -F "scan_type=Nmap Scan" \
  -F "file=@nmap-results.xml" \
  -F "engagement=12"
# Réimporter pour mettre à jour un ensemble de findings existant (dédup/fusion)
curl -X POST "https://<dojo-host>/api/v2/reimport-scan/" \
  -H "Authorization: Token <api-key>" \
  -F "scan_type=Burp Scan" \
  -F "file=@burp-results.xml" \
  -F "test=45"
# Lister les findings via l'API
curl -H "Authorization: Token <api-key>" \
  "https://<dojo-host>/api/v2/findings/?active=true&severity=Critical"

Notes

  • Supporte 100+ formats d’import de scanners d’origine (Nmap, Nessus, Qualys, Burp, ZAP, Semgrep, Trivy, Gitleaks, etc.)
  • Organise le travail en Products → Engagements → Tests → Findings, ce qui colle à la structure typique d’un programme pentest/AppSec
  • Dispose d’une logique de déduplication pour fusionner les findings répétés entre réimports/réscans, utile pour suivre la remédiation dans le temps
  • Le module de reporting génère des rapports PDF/Word prêts pour le client directement à partir des findings suivis
Aide / Page de manuel 
DefectDojo is a Django web application — no traditional CLI/man page.

Local setup:
  docker compose up -d
  Default UI: http://localhost:8080

REST API (v2):
  POST /api/v2/import-scan/     import a new scan's findings
  POST /api/v2/reimport-scan/   re-import into an existing test (dedup)
  GET  /api/v2/findings/        list/query findings
  GET  /api/v2/engagements/     list engagements
  GET  /api/v2/products/        list products

Auth:
  Header: Authorization: Token <api-key>
  API key found under: User Profile → API v2 Key