Ability to embed a document/object

[silent6trinity]

When writing reports, I run into situations where I need to embed a file into a finding or a large scope list within the Scope section. Instead of having to manually list every asset out within markdown, it'd be nice to have a way to embed an actual document into the report.

[aronmolnar]

What kind of document would this be (e.g. what file type)?

[silent6trinity]

What kind of document would this be (e.g. what file type)?

Typically, i'd be looking to actually embed either another .pdf, or typical office files; (.docx, .xls, etc.)

[silent6trinity]

Has there been any work regarding this? I know you have recently pushed out a way to import objects/files - but is there a way to embed files within the report PDF?

[aronmolnar]

I haven't yet understood what you want to achieve by embedding files in a PDF (PDF is not a container, it's a document).
Can you provide a sample PDF what this would look like?

[silent6trinity]

Often times for tests, (while currently using Microsoft Word for reporting) I will need to embed the agreed upon scope list of IP addresses/domain names into the report as an .xls file. This is typically done by inserting an object into the .docx file, allowing recipients to click the icon to open the file, rather than sending the .xls file as a separate attachment.

Currently, to achieve this when using a .pdf, I need to edit the PDF in Adobe Acrobat after generating the report > comments > attach file. This creates a clickable icon within the PDF that allows the recipient to click the icon and open the embedded file from the report.

I've included an image which depicts what i'm speaking of.

[aronmolnar]

All clear - tbh I did not know this is possible in PDFs.

This seems to be possible using WeasyPrint.
@MWedl Can you have a look at this (https://doc.courtbouillon.org/weasyprint/stable/api_reference.html#pdf)?

If this works flawlessly, we could allow uploading files to markdown fields (additionally to images). Passing the files to the rendering job could work just as it does with images.

Concerns would be:

• Large PDF file size due to large embedded files
• Users might upload files there and not know they are then embedded to the PDF

[richardschwabe]

I think generally an importer would make sense, for importing the usual: nmap, burpsuite/zap, nessus/qualys/openvas, nikto, wpscan and maybe a basic txt file with each line = a list item.

[aronmolnar]

Ad importer:
There will be a SysReptor CLI that can be used as an importer.

Ad txt:
This works with the standard list object: