A pentesting engagement ends with a report. The quality of that report depends on how you managed the work from day one.
The engagement is over. You have findings across three different text files, screenshots in a folder with no names, CVSS scores worked out by hand in a spreadsheet, and the exploitation evidence in some screenshot you can no longer find.
Now you have to write the report.
Gungnir was built so that never happens again. One platform that follows every phase of the engagement, from first contact with the client to the delivered PDF, with every tool a professional offensive team needs and no reason to leave it.
structured phases: Planning · Recon · Scanning · Exploitation · Post-Exp · Reporting
searchable pentesting commands in the arsenal, inside the same platform
external tools needed to put the final report together
Every phase of the engagement exactly where it belongs. Nothing out of context.
Gungnir is not a task list with a text editor. It models exactly how an offensive team works, with the structure needed to turn technical work into a professional report without friction. For non-standard engagements, switch on custom mode: freely named phases, a work plan, progress updates and documents attached per phase. Ideal for red team work, complex application audits and consulting.
Planning
In-scope and out-of-scope assets with annotations, engagement objectives and rules of engagement. The agreement with the client documented before any technical activity begins.
Reconnaissance
Shodan, VirusTotal, Censys, crt.sh, RDAP and DNS integrated straight into the engagement. Your own API keys, no vendor lock-in, and none of your queries travelling through third-party infrastructure.
Scanning
Import the .nessus file, Burp’s XML, OpenVAS’s or Nmap’s -oX and the findings land structured straight into the engagement. No copy and paste. No severity lost in translation.
Exploitation
Operation logs with timestamp, target, tool, exact command and notes. When the client asks what was done and when, the record is there, complete, with nothing reconstructed from memory.
Post-Exploitation
Evidence uploaded straight into the engagement. MITRE ATT&CK mapping at technique and tactic level. The attack path documented while it happens, not reconstructed at the end.
Reporting
The PDF is generated from the findings already documented. Executive and technical sections. Operator logo. The report that used to take a day of formatting in Word now takes minutes.
Everything a professional offensive team needs. In one place.
Every Gungnir module exists because someone needed it in a real engagement. Not catalogue features, real tools for real offensive work.
Findings editor with visual CVSS 3.1
You enter the finding and the CVSS 3.1 calculator is interactive: pick AV, AC, PR, UI, Scope, C, I and A from buttons and the score updates in real time. No formulas, no spreadsheets, no arithmetic mistakes for the client to catch in review. Every finding also carries CWE and OWASP Top 10 mapping, MITRE tactic and technique, the affected asset, a technical description, steps to reproduce and an executive summary.
CVE auto-populate from NVD
You found a known vulnerability. Enter the CVE ID and Gungnir queries the NVD API on the spot, filling in the CVSS vector, the score, the official description and the CWE automatically. No searching nvd.nist.gov, no copying the vector by hand, no risk of mistyping a component. For findings that carry a CVE, documentation time drops from minutes to seconds.
Scanner XML import
El resultado del Nessus, del Burp, del OpenVAS o del Nmap entra en el engagement con un upload. Gungnir parsea el XML, mapea la severidad al esquema propio y crea los hallazgos estructurados. Lo que antes era abrir el reporte del scanner en paralelo y copiar cada finding a mano ahora es un drag and drop. Directo en la fase del engagement que corresponde.
Arsenal of 2,300+ commands
Search for "kerberoasting" and up come the Impacket, Rubeus and PowerView commands with the right flags. Search for "subdomain" and you get gobuster, ffuf, amass and dnsrecon. Categorized into Recon, Web, Network, Active Directory, Post-Exploitation, Evasion and more, with full-text search across name, description and command. Sin salir de la plataforma, sin buscar en cheatsheets dispersos.
Finding templates
15 preconfigured templates for the most frequent findings: SQLi, XSS, CSRF, SSRF, XXE, RCE, path traversal, open redirect, default credentials and more. Load the template, adjust the details for the specific engagement, and the finding is professionally documented in seconds. Plus your own custom library for the ones you repeat on every engagement.
Integrated OSINT and recon
Shodan for IP intelligence, open ports and CVEs. VirusTotal for domain and IP reputation. Censys for certificates and infrastructure. crt.sh to enumerate subdomains through certificate transparency. RDAP for domain records and registrant data. DNS for A, MX, NS, TXT and CNAME resolution. All of it inside the engagement’s reconnaissance phase, with your own API keys and no vendor lock-in.
Reporting PDF profesional
The PDF is generated from the findings already loaded into the engagement. An executive section with the risk summary and statistics. A technical section with every finding in detail, severity, CVSS, description, steps to reproduce and recommendations. The operator’s logo is uploaded from the profile. The report that shapes how the client sees your work, generated from the data you already documented during the engagement.
Notes, scripts and writeups
Personal notes in Markdown with tags, pinning and a fully rendered viewer, shareable with other team members and linkable to a specific engagement. A manager for the scripts you use on every engagement. A library of vulnerability writeups for reference and internal documentation. All the team’s knowledge in one place, at hand while you work.
Attack Map, interactive network topology
A visual canvas of the engagement’s infrastructure: add nodes (IPs, FQDNs, URLs) with operating-system icons (Windows, Linux Server, Kali, Parrot, router, switch, firewall, IoT and more), connect them to document lateral movement, and mark compromised targets. It populates automatically by importing the scope or syncing from scanning and exploitation logs. Nodes and ports are exported inside the engagement archive, compatible between Community and Pro.
Research Papers, structured editor with Exploit-DB
A vulnerability paper editor with predefined sections: abstract, technical description, threat scope, methodology, base case analysis, exploitability and impact, technical evidence and PoC, downloads, mitigations, ethical considerations and conclusion. Exportable to PDF. Exploit-DB integration: search and download papers straight from Gungnir with automatic content detection (PDF versus text or code), save favourites per operator and build your internal research library.
Portable engagements
A complete engagement is exported to a single file and imported again on another installation: findings, phases, operation logs, scope, attack map and evidence, all inside. Useful for moving work between installations, for archiving a closed engagement and for handing a case to another operator without re-entering anything. It is compatible with the Community edition.
Real-time team work
Several operators on the same engagement, seeing what the others load at the moment they load it. Findings, operation logs and phase progress update on their own on everyone’s screen, so two people do not document the same finding or step on each other’s work. On a team working against the clock, that is the difference between coordinating and getting in the way.
Remediation and retest lifecycle
The finding does not end at delivery. Each one carries its remediation due date and its retest: when the client reports a fix, you mark it remediated, partially mitigated or still exploitable, and the platform keeps the severity it came in with to show the change between the initial report and the retest. If the client chooses to live with the risk, the acceptance is recorded with its reason, which is what the audit asks for later. And when a finding of relevant severity comes in, an alert by email or webhook.
Time tracking and methodology coverage
Hours logged per phase and per operator, with the total and the breakdown in plain sight. And a coverage checklist over OWASP WSTG 4.2 and PTES: each control is marked tested, not applicable or pending, with the coverage percentage over what actually applies. It is the report’s quality control, what was tested and what was not, and the basis to justify the engagement’s effort.
Evidence annotations and ATT&CK Navigator layer
You mark the problem right on the screenshot, with rectangles, arrows and freehand, and it is saved as new evidence. And the engagement’s techniques export as a MITRE ATT&CK Navigator layer, the same format Gjallarhorn uses, so the offensive and defensive sides speak the same language.
Purple bridge with the SOC · Pro
You upload the defensive team’s detection layer (exported from Gjallarhorn) and Gungnir crosses it against the techniques exercised in the engagement: it shows what the SOC detected, what it saw partially and, above all, the detection gaps. It is the Purple exercise done with a file, without coupling the two systems.
Read-only client portal · Pro
A link for the client to see the status of their findings and their remediation with no account. The view is sanitized: severities, status, recommendations, nothing of the internal work. The link is revocable and expires, and access is logged.
Encrypted credential vault · Pro
The credentials captured during the work (passwords, hashes, keys, tokens) live encrypted with AES-256-GCM per engagement. They are never shown in the list: one is revealed and copied on demand, and it stays in the audit log. A database dump does not reveal the secrets.
Recurring-findings knowledge base · Pro
Per client, the findings already reported across more than one engagement, with how many times they appeared and whether they are still open. It answers the retest question, we already reported this, was it fixed?, and feeds the conversation with the client.
This is not a demo. This is Gungnir running on an engagement.
Twenty-one seconds of an actual walkthrough: the dashboard with open findings by severity, the exploitation phase with its logged attempts, the attack map, the command arsenal, the finding library with its CVSS, and the report assembling itself from what was already recorded.
Click here and request a live demo with our team. We walk you through the whole platform, module by module, with your own scenario on the table, answering anything you want to ask.
Every command run, every exploitation attempt and every finding is recorded in its phase as the work happens. By delivery time the report is already assembled. That week of writing at the close is the one nobody budgets for, and the one that always eats the margin.
The vector is built component by component and the score moves on its own. The library ships the common findings already written, with their CWE, steps to reproduce and recommendation, so two analysts do not describe the same vulnerability in two different ways.
Which hosts were reached, where the pivot went through and which ones ended up compromised, in a diagram that exports straight into the report. It is what a board understands at a glance, without reading thirty technical pages.
Nearly two hundred commands sorted by phase and by tool, each mapped to its MITRE ATT&CK technique. The knowledge stops living in the shell history of whoever did the job last time.
The team works at the same time and changes show up as they happen, with nobody overwriting anyone and no spreadsheets to reconcile at the end of the day. Every action is stamped with its author and time in the audit log.
Scope, exclusions, the authorised window and the emergency contact are loaded before starting and stay visible throughout. A pentest that steps outside its scope is a legal problem, not a technical one.
Gungnir Community Edition: the complete system, free, forever.
The same platform AllSafe uses on its engagements, released as free software. No engagement limits, no sign-up, no subscription. Install it on your own server and it is yours.
Full lifecycle, CVSS 3.1 editor, XML import, an arsenal of 2,300+ commands, OSINT with your own API keys, 15 built-in templates, shareable notes and PDF reporting, all included in the Community Edition.
A pentester who manages engagements badly delivers reports that do not reflect the quality of the technical work.
The most rigorous offensive work loses value when the report is a pile of improvised notes. Gungnir closes that gap between technical quality and deliverable quality.
The report comes out of the data
Everything you documented during the engagement, findings, evidence, CVSS scores and MITRE mappings, is exactly what appears in the final PDF. No reformatting, no trying to remember what happened during exploitation.
Traceability the client can audit
Every command run, every finding entered and every piece of evidence uploaded is tied to its phase, its timestamp and its operator. When the client asks how access was obtained, the answer is in the system.
The arsenal where you need it
You never leave the platform to look up the kerberoasting command, the SSRF payload or the SQLi template. The team’s technical knowledge lives inside the same tool that runs the engagement.
Built by an offensive team
Gungnir is not a project manager bent into pentesting. It is a platform designed from the first commit around the exact workflow of a professional offensive team. AllSafe runs its own engagements on it.
Want Gungnir on your next engagement
The Community Edition is on GitHub, self-hosted, no sign-up, AGPL-3.0. If you need Gungnir Pro with live Nessus and OpenVAS feeds, AllSafe CRM sync, an executive operations dashboard, custom PDF branding, the Purple bridge with the SOC, the client portal, the encrypted credential vault and the recurring-findings knowledge base, get in touch.