Batch export for projects data and template findings

[noraj]

There is an export button on each project. But there is no export button to export all projects at once. Same for finding templates.

[silent6trinity]

Bumping this, as being able to batch export & batch import the findings template(s) would be an enormous time saver.

[aronmolnar]

Batch export is still in our backlog, but we're not yet actively working on in.

However, batch import is already possible by combining multiple tar.gz files (this works with templates, designs, projects):

Pack exported SysReptor items

You want to pack multiple projects/designs/templates to one tar.gz.

1. Put them into one directory

$ ls
'template-Cross-Site-Request-Forgery-(CSRF).tar.gz'               template-Session-management-weaknesses.tar.gz
 template-Disclosure-of-sensitive-data-in-URL-parameters.tar.gz  'template-Stored-Cross-Site-Scripting-(XSS).tar.gz'
 template-Incorrectly-configured-HTTP-security-headers.tar.gz     template-Untrusted-TLS-certificates.tar.gz
 template-Insecure-HTTP-cookies.tar.gz                            template-User-Enumeration.tar.gz
'template-SQL-Injection-(SQLi).tar.gz'                           'template-XML-External-Entity-Injection-(XXE).tar.gz'

2. Unpack, Repack

cat *.tar.gz | tar zxvf - -i && tar -czvf all.tar.gz *-assets *-images *.json 2>/dev/null || rm -rf *-assets *-images *.json 2>/dev/null

Your items will be packed to all.tar.gz

Update: Batch export is now possible via our cli tool (#23 (comment))

[noraj]

Batch export is still in our backlog, but we're not yet actively working on in.

Should be quick and easy to implement.

The function could be a loop over the existing export function for each template (and having n .tar.gz of 1 .json) or a new function a bit different so we would have 1 .tar.gz with n .json.

A new root /api/v1/findingtemplates/export/ (without UUID).

A new export button, calling the new export API endpoint.

[noraj]

Temporary batch export workaround

I made a JavaScript script that will call the individual export API endpoint for each vulnerability template as a workaround waiting for the true batch export feature.

https://github.com/noraj/Pentest-collab-convert/blob/master/tools/sysreptor/export_all_vulns.js

cc @silent6trinity @aronmolnar

[aronmolnar]

Batch export of templates is now possible via reptor CLI.

pip3 install reptor
reptor conf
reptor template --export tar.gz

[noraj]

Nice feature but I fear I won't be able to use reptor much since I protected my sysreptor instance with a reverse proxy and client certificate authentication (eg. similar to what is explained in this article). That's why having it in the WebUI would be nice as well.

[aronmolnar]

Good hint :)
Yes, it should also be in the webui.

And in reptor we could add the possibility to specify a client certificate.

[MWedl]

The web UI now supports bulk select and bulk export in list views