cervantessec/cervantesOpen-source collaborative platform for pentesters and red teams to manage projects, clients, vulnerabilities, and generate OWASP-compliant reports from a centralized workspace.
 <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section --> [](#contributors-) <!-- ALL-CONTRIBUTORS-BADGE:END --> [](https://github.com/CervantesSec) [](https://twitter.com/Cervantes_Sec) [](https://www.cervantessec.org) [](https://discord.gg/BvzNjT3Qzc) [](https://docs.cervantessec.org/) Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients, vulnerabilities, and reports in a single, centralized location. By facilitating efficient data management and providing a unified workspace, Cervantes aims to significantly reduce the time and effort required in the coordination and execution of penetration testing activities. ## Supported Cervantes is an [OWASP Foundation](https://owasp.org/www-project-cervantes/) Project <img src="https://assets.kitploit.com/production/public/readmes/5431/8902e5836a324eae0ab281a9be7d62683e025d503ce6778cce6768fb908c1089.png" width="500" height="150"> ## Technologies       ## Features * OpenSource * Multiplatform * Multilanguage * Team Collaboration * Checklists * OWASP Compliance Reports * Built-in dashboards and analytics * Manage your clients and Offensive Security projects * One click reports creation * And more ## Runtime requirements - Docker - Docker compose ## How to run it locally with Docker compose * First you need to clone this repository ```sh git clone https://github.com/CervantesSec/docker.git ``` * After that you need to start your docker containers: ```sh docker-compose -p cervantes -f docker-compose.yml up -d ``` * After this, open your browser at http://localhost or https://localhost and you will see the Cervantes login page. ### Default User and Password When you first launch the Cervantes application, a default user is created for you. The default username is `[email protected]`. The password for this user is generated randomly during the creation of the application container and the first launch of the application. This means that the password is unique for each instance of the application and provides an additional layer of security. <img src="https://assets.kitploit.com/production/public/readmes/5431/188a9dc50de7f7a0250aaffbd1785cd78ff804c55d2f18e3ace6d3542fe7f11c.png" width="800" height="500"> Please note that it's important to change the default password as soon as possible to ensure the security of your application. You can do this by logging in with the default user and navigating to the user settings page. Remember, the security of your application is paramount. Always use strong, unique passwords and change them regularly. ## How to run it locally from source ### Requirements - [.NET 8](https://dotnet.microsoft.com/en-us/download/dotnet/8.0) - [PostgresSQL](https://www.postgresql.org/) - [Atlassian Jira Server](https://www.atlassian.com/es/software/jira) (Optional only if you want to use Jira Integration) #### How to run it locally To install the Cervantes application from the source code, you can follow these steps: * **Clone the Repository**: First, you need to clone the repository from GitHub. You can do this by running the following command in your terminal: ```bash git clone https://github.com/CervantesSec/cervantes.git ``` * **Navigate to the Project Directory**: Once the repository is cloned, navigate to the project directory: ```bash cd Cervantes ``` * **Edit appsettings.json**: To use the application you need to edit the appsettings.json file inside the Cervantes.Web folder. **Database Connection String** The database connection string is used to connect your application to your database. It usually includes the server name, database name, and authentication details. Here's an example of how it might look in your `appsettings.json`: ```json { "ConnectionStrings": { "DefaultConnection": "Server=myServerAddress;Database=myDataBase;Username=myUsername;Password=myPassword" } } ``` Replace `myServerAddress`, `myDataBase`, `myUsername`, and `myPassword` with your actual database details. * **Install Dependencies**: The project uses .NET 8.0, so you need to have it installed on your machine. If you don't have it, you can download it from the [official .NET website](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). Once .NET is installed, you can install the project dependencies by running: ```bash dotnet restore ``` * **Build the Project**: After the dependencies are installed, you can build the project: ```bash dotnet build ``` * **Run the Project**: Finally, you can run the project: ```bash dotnet run --project Cervantes.Web/Cervantes.Web.csproj ``` The application should now be running at `http://localhost:5235`. Please note that this is a basic installation guide and the actual process might vary depending on the project's specific configuration and requirements. For example, if the project uses a database, you might need to set up the database and update the connection string in the configuration file. ## How to contribute Here are some things you could do to become a contributor: - **★ Star this project on GitHub ★** - Suggest new features or ideas - Improve the code of the platform components - Report security issues Before you jump to make any changes make sure you have read the [contributing guidelines](https://github.com/cervantessec/cervantes/blob/master/CONTRIBUTING.md). This would save us all time. Thanks! [](https://www.paypal.com/donate/?hosted_button_id=YS42VF2N9GANA) ## Security Please report Security issues via our [disclosure policy](https://github.com/CervantesSec/cervantes/blob/main/SECURITY.md). ## How to report bugs If you have bugs to report please use the [issues](https://github.com/CervantesSec/cervantes/issues) tab on GitHub to submit the details. ## Contributors <!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section --> <!-- prettier-ignore-start --> <!-- markdownlint-disable --> <table> <tbody> <tr> <td align="center" valign="top" width="14.28%"><a href="https://github.com/mesquidar"><img src="https://assets.kitploit.com/production/public/readmes/5431/333d290edf7cc5f3e8185d9af33b84152a3e3569bf6d568b7afd6253dc890bf9.png" width="100px;" alt="Ruben Mesquida"/><br /><sub><b>Ruben Mesquida</b></sub></a><br /><a href="#business-mesquidar" title="Business development">💼</a> <a href="https://github.com/CervantesSec/cervantes/commits?author=mesquidar" title="Code">💻</a> <a href="https://github.com/CervantesSec/cervantes/commits?author=mesquidar" title="Documentation">📖</a> <a href="#translation-mesquidar" title="Translation">🌍</a></td> <td align="center" valign="top" width="14.28%"><a href="https://github.com/abutcher"><img src="https://assets.kitploit.com/production/public/readmes/5431/1d72bec5c5526c6fa476aad512407b600509b38cdf04079d3c3fa4ee1be382dd.png" width="100px;" alt="abutcher"/><br /><sub><b>abutcher</b></sub></a><br /><a href="https://github.com/CervantesSec/cervantes/commits?author=abutcher" title="Code">💻</a></td> <td align="center" valign="top" width="14.28%"><a href="https://github.com/samogod"><img src="https://assets.kitploit.com/production/public/readmes/5431/ae24d701b2d7187d80141a205a313b09e76814b1d03a0074ded2a53a2b9e006d.jpg" width="100px;" alt="samet g."/><br /><sub><b>samet g.</b></sub></a><br /><a href="#translation-samogod" title="Translation">🌍</a> <a href="https://github.com/CervantesSec/cervantes/commits?author=samogod" title="Code">💻</a></td> <td align="center" valign="top" width="14.28%"><a href="https://github.com/EmiliaChovancova"><img src="https://assets.kitploit.com/production/public/readmes/5431/d1c3191010b66d05c2e21abc98691460e678c18f03609b052c869b90a5294359.png" width="100px;" alt="EmiliaChovancova"/><br /><sub><b>EmiliaChovancova</b></sub></a><br /><a href="https://github.com/CervantesSec/cervantes/issues?q=author%3AEmiliaChovancova" title="Bug reports">🐛</a></td> <td align="center" valign="top" width="14.28%"><a href="https://github.com/jstangle"><img src="https://assets.kitploit.com/production/public/readmes/5431/24e02534d77beb34ae96d41515f91cc88044a76dc766ab86de0f1321ed7dc2f1.jpg" width="100px;" alt="jstangle"/><br /><sub><b>jstangle</b></sub></a><br /><a href="https://github.com/CervantesSec/cervantes/issues?q=author%3Ajstangle" title="Bug reports">🐛</a></td> <td align="center" valign="top" width="14.28%"><a href="https://github.com/Th34t0m1c"><img src="https://assets.kitploit.com/production/public/readmes/5431/7699af64e0c3ee31a35c1f6148b433ebd5ebe1bab6cacbcaeaef18a52ceca3b6.jpg" width="100px;" alt="Th34t0m1c"/><br /><sub><b>Th34t0m1c</b></sub></a><br /><a href="#translation-Th34t0m1c" title="Translation">🌍</a></td> <td align="center" valign="top" width="14.28%"><a href="https://github.com/gomezander"><img src="https://assets.kitploit.com/production/public/readmes/5431/b35ba62d0a64a50e98de946fe13953737be14d1a46a7053882009a5d5a6281de.png" width="100px;" alt="Ander Gómez"/><br /><sub><b>Ander Gómez</b></sub></a><br /><a href="https://github.com/CervantesSec/cervantes/commits?author=gomezander" title="Documentation">📖</a></td> </tr> <tr> <td align="center" valign="top" width="14.28%"><a href="https://github.com/jpostolk"><img src="https://assets.kitploit.com/production/public/readmes/5431/69a1a2bb19faf17f5f31aabad73c6373aea232a175e516d05cc80462709015b3.png" width="100px;" alt="jpostolk"/><br /><sub><b>jpostolk</b></sub></a><br /><a href="https://github.com/CervantesSec/cervantes/issues?q=author%3Ajpostolk" title="Bug reports">🐛</a></td> </tr> </tbody> </table> <!-- markdownlint-restore --> <!-- prettier-ignore-end --> <!-- ALL-CONTRIBUTORS-LIST:END --> <!-- prettier-ignore-start --> <!-- markdownlint-disable --> <!-- markdownlint-restore --> <!-- prettier-ignore-end --> <!-- ALL-CONTRIBUTORS-LIST:END --> ## License This project is licensed under the GNU Affero General Public License (AGPL-3.0), except for specific components that remain licensed under the Apache License 2.0. [](https://www.gnu.org/licenses/agpl-3.0.html) [](https://www.apache.org/licenses/LICENSE-2.0.html) ### Summary: AGPL-3.0 applies to the majority of the project. Apache License 2.0 applies to the components listed in the NOTICE file. For more details, see the full LICENSE and NOTICE files included in this repository. ## Copyright Notice Copyright (C) 2025 Ruben Mesquida Gomila OWASP Cervantes and all contributions are protected under their respective licenses. For more information on license terms, visit: - https://www.gnu.org/licenses/agpl-3.0.html - https://www.apache.org/licenses/LICENSE-2.0.html
