Ghostwriter v3.0.0

[chrismaddalena]

Summary

This is the final release for v3.0.0. This release includes all the changes and features of the tagged v2.3.0-rc2 and v3.0.0-rc1 releases. There is a consolidated CHANGELOG below.

For existing installations of v2.x.x, please refer to the updated installation guide and new update guide.

Before building any containers, you will need to migrate your current PostgreSQL username and password. Get your username and password from the old .envs/.production/.postgres file and run these commands:

./ghostwriter-cli config set POSTGRES_USER <YOUR USERNAME>
./ghostwriter-cli config set POSTGRES_PASSWORD <YOUR PASSWORD>
./ghostwriter-cli config containers build
./ghostwriter-cli config containers up

Note on the API: Until cobalt_sync and mythic_sync are updated, the old REST API keys will still be issued for activity logging. In the near future, these projects will switch to using the GraphQL API and new API tokens, and a v3.x.x release will remove the old REST API endpoints and keys. This will also provide time for any other projects that use the REST API to switch to the GraphQL API.

CHANGELOG

[3.0.0] - 22 June 2022

Added

• Committed Ghostwriter CLI binaries (v0.2.1) for Windows, macOS, and Linux
• Added support for CVSS scoring with a calculator for findings (big thanks to @therealtoastycat and PR add CVSS feature #189)
• Added user controls for generating and revoking API tokens from the user profile page
• Added Hasura GraphQL engine to production environments
• Usernames are now clickable and open the user's profile page for viewing
• User profiles now have a role field for managing permissions in the upcoming GraphQL API
• Added support for block quotes in report templates and WYSIWYG editor
• Added ProjectInvite and ClientInvite models to support role-based access controls in the GraphQL API
• Added a menu option to export a project scope to a text file from the project dashboard
  • Exports only the scope list for easy use with other tools–e.g., Nmap

Changed

• Ghostwriter CLI will now be used for installation, configuration, and management of the Ghostwriter server
• Docker will now use one .env file with values for all environments
  • The file is generated by Ghostwriter CLI
• Updated style of the finding preview pages for the finding library
• Updated style of notes to make them cleaner and easier to manage
• Project dashboard's "Objectives" tab will now show the current number of incomplete objectives and update when toggling objectives
• Updated keyword reference panel displayed when editing findings
• Subtask forms for objectives will now default to the objective's deadline date instead of "today"
• Objective deadlines will now be automatically adjusted when the parent objective's deadline changes
• Disabled L10N by default in favor of using DATE_FORMAT for managing the server's preferred date format (closes Error: Encountered an error generating the document: time data fév. 4, 2022 does not match format %b. %d, %Y (french language) #193)
• User profiles now only show the user's role, groups, and Ghostwriter user status to the profile owner
• Updated nginx.conf to align it with Mozilla's recommendations for nginx v1.21.1 and OpenSSL 1.1.1l
  • See config: https://ssl-config.mozilla.org/#server=nginx&version=1.21.1&config=intermediate&openssl=1.1.1l&ocsp=false&guideline=5.6
• Toast messages for errors are no longer sticky so they do not have to be manually dismissed when covering UI elements
• Domain list table now shows an "Expiry" column and "Categories" column now parses the new categorization JSON field data
• Domain list filtering now includes a "Filter Expired" toggle that is on by default
  • Filters out domains with expiration dates in the past and auto_renew set to False even if status is set to "Available"
• The table on the domain list page and the menu on the domain details page will no longer disable the check out option if a domain's status is set to "Burned"
• Simplified usage of the format_datetime filter
  • Filter now accepts only two arguments: the date and the new format string
  • Format string should use Django values (e.g., M d, Y) instead of values translated to Python's standard (e.g., %b %d, %Y)
• Simplified usage of the add_says filter
  • Filter now accepts only two arguments: the date and an integer

Deprecated

• The individual .env files stored in .envs/ are no longer used and will be ignored by v3.x.x and later
• v2.2.x usage of the format_datetime and add_days filters is deprecated in v2.3.0
  • Both filters will no longer accept Python-style strftime strings
  • Both filters no longer needs or accepts the current_format and format_str parameters
  • Templates using the old style will fail linting

Removed

• Removed old environmnt variable templates from the project because they are no longer used for setup or management
• Removed unnecessary status badges on tabs in the project dashboard that were confusing and not very helpful
• Revoked direct insert permissions for History and ServerHistory tables used for tracking domain and server checkouts
• Removed "WHOIS Privacy" column on domain list page to make room for more pertinent information

Fixed

• Upgraded django-bleach dependency to fix error with latest python-bleach (Fixes Template error when viewing clients in v2.2.3 #208)
• Fixed error that blocked creation of default BlockQuote style in the report template
• Fixed domain age column not sorting correctly in domain library table
• Checkbox in server form will no longer appear way bigger than intended
• Fixed issue where <em> tags could cause report generation to fail
• Bumped djangorestframework-api-key to v2.2.0 to fix REST API key creation (closes Unable to create oplogs (error in creating a new API key) #197)
• Fixed project dashboard's "Import Oplog" button not pointing to the correct URL
• Fixed URL conflicts with export links for domains, servers, and findings

Security

• Restricted edit and delete actions on notes to close possibility of other users editing or deleting notes they do not own

---

This discussion was created from the release Ghostwriter v3.0.0.