faradaysec/faraday repository overview

⁠

⁠Open Source Vulnerability Manager

Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your terminal and get your work organized on the run. Faraday was made to let you take advantage of the available tools in the community in a truly multiuser way.

Faraday aggregates and normalizes the data you load, allowing exploring it into different visualizations that are useful to managers and analyst alike.

To read about the latest features check out the release notes⁠!

⁠Install

⁠Docker-compose

The easiest way to get faraday up and running is using our docker-compose

$ wget https://raw.githubusercontent.com/infobyte/faraday/master/docker-compose.yaml
$ docker-compose up

If you want to customize, you can find an example config over here Link⁠

⁠Docker

You need to have a Postgres⁠ running first.

 $ docker run \
     -v $HOME/.faraday:/home/faraday/.faraday \
     -p 5985:5985 \
     -e PGSQL_USER='<postgres_user>' \
     -e PGSQL_HOST='<postgres_ip>' \
     -e PGSQL_PASSWD='<postgres_password>' \
     -e PGSQL_DBNAME='<postgres_db_name>' \
     faradaysec/faraday:latest

⁠Getting Started

Learn about Faraday holistic approach and rethink vulnerability management.

• Centralize your vulnerability data⁠
• Automate the scanners you need⁠

⁠Integrating faraday in your CI/CD

Setup Bandit and OWASP ZAP in your pipeline

• GitHub⁠ [PDF]
• Jenkins⁠ [PDF]
• TravisCI ⁠ [PDF]

Setup Bandit, OWASP ZAP and SonarQube in your pipeline

• Gitlab⁠ [PDF]

⁠Faraday cli

Faraday-cli is our command line client, providing easy access to the console tools, work in faraday directly from the terminal!

This is a great way to automate scans⁠, integrate it to CI/CD pipeline⁠ or just get [metrics](https://docs.faraday-cli.faradaysec.com/commands/#stats⁠ from a workspace.

$ pip3 install faraday-cli

Check our faraday-cli⁠ repo

Check out the documentation here⁠.

⁠Faraday Agents

Faraday Agents Dispatcher⁠ is a tool that gives Faraday⁠ the ability to run scanners or tools remotely from the platform and get the results.

⁠Plugins

Connect you favorite tools through our plugins⁠. Right now there are more than 80+ supported tools⁠, among which you will find:

Missing your favorite one? Create a Pull Request⁠!

There are two Plugin types:

Console plugins which interpret the output of the tools you execute.

$ faraday-cli tool run \"nmap www.exampledomain.com\"
💻 Processing Nmap command
Starting Nmap 7.80 ( https://nmap.org ) at 2021-02-22 14:13 -03
Nmap scan report for www.exampledomain.com (10.196.205.130)
Host is up (0.17s latency).
rDNS record for 10.196.205.130: 10.196.205.130.bc.example.com
Not shown: 996 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
443/tcp  open   https
2222/tcp open   EtherNetIP-1
3306/tcp closed mysql
Nmap done: 1 IP address (1 host up) scanned in 11.12 seconds
⬆ Sending data to workspace: test
✔ Done

Report plugins which allows you to import previously generated artifacts like XMLs, JSONs.

faraday-cli tool report burp.xml

Creating custom plugins is super easy, Read more about Plugins⁠.

⁠API

You can access directly to our API, check out the documentation here⁠.

⁠Links

• Homepage: faradaysec.com⁠
• Documentation: Faraday Docs⁠
• Download: Download .deb/.rpm from releases page⁠
• Issue tracker and feedback: Github issue tracker⁠
• Frequently Asked Questions: FaradaySEC FAQ⁠
• Twitter: @faradaysec⁠
• Try one of our Demos⁠