factionsecurityllc/owasp-faction repository overview

OWASP FACTION — Open Source Pentest Reporting & Collaboration Engine Tired of copy-pasting findings into Word docs at 2am after a pentest? FACTION is the open source platform built by pentesters for pentesters to kill that workflow dead.

FACTION handles your entire assessment lifecycle; from scheduling engagements and documenting findings in real time, to peer review, client-ready report generation, and remediation tracking. All in one self-hostable platform.

Built for how you actually work:

• Burp Suite integration — push findings directly from Burp into your report without context switching
• 75+ vulnerability templates pre-loaded and fully customizable — stop rewriting the same XSS writeup forever
• DOCX report templates so clients get the polished deliverable they expect, generated automatically
• Peer review & tracked changes for team assessments and quality control Custom SLAs and remediation tracking — know when your vulns go stale
• Full REST API + plugin system — extend it like Burp Extender; integrate Jira, ticketing, or whatever your workflow needs
• AI-assisted reporting — draft findings faster with LLM integrations (Anthropic, OpenAI, Azure)
• MCP server support for agentic security tooling workflows

Self-host it in minutes with Docker, own your data, and extend it however you want. OIDC, SAML, LDAP, and GitHub auth all supported out of the box.

Links:

• Git Hub⁠
• Doc Portal⁠
• WebSite⁠

Get running in minutes. Copy the following text into docker-compose.yml then run docker compose up.

services:
  faction-mongo:
    image: mongo:8.0
    ports:
      - "27017:27017"
    volumes:
      - "~/.faction/data-dev:/data/db"
  tomcat-service:
    image: factionsecurityllc/owasp-faction:latest
    volumes:
      # Mount exploded WAR directory for hot reload
      - ./target/faction:/usr/local/tomcat/webapps/ROOT
    environment:
      - "FACTION_MONGO_HOST=faction-mongo"
      - "FACTION_MONGO_DATABASE=faction"
      - "FACTION_SECRET_KEY=faction_encryption_key"
      - "FACTION_OAUTH_CALLBACK=http://localhost:8080"
      - "JAVA_OPTS=-Dfile.encoding=UTF-8 -Xms512m -Xmx1024m 
    links:
      - faction-mongo
    command: ["/usr/local/tomcat/bin/catalina.sh", "run"]
    ports:
      - "8080:8080"
    depends_on:
      - faction-mongo