Export Formats

Beyond the PDF: Integration With Reporting Platforms

While TurboPentest's PDF reports are comprehensive standalone deliverables, many security teams manage their pentest findings within dedicated reporting platforms. These platforms provide collaboration features, finding lifecycle management, retesting workflows, and client portals that complement TurboPentest's automated output.

TurboPentest supports export to four major pentest reporting platforms: PlexTrac, Dradis, AttackForge, and Ghostwriter. Each export produces a format native to the target platform, so findings import cleanly without manual reformatting. Generic JSON, Markdown, XML, and CSV exports are also available for custom pipelines. In every format, findings are sorted by severity from critical to info.

PlexTrac Export

PlexTrac is a security assessment management platform used by pentest consultancies and internal security teams. It provides client management, finding tracking, report generation, and analytics dashboards.

TurboPentest exports findings in PlexTrac's CSV import format, mapping fields as follows:

• Finding Title maps to PlexTrac's title field
• Severity maps to PlexTrac's severity levels (Critical, High, Medium, Low, Informational)
• Description maps to the finding description field
• Remediation maps to the recommendations field
• CVSS Score maps to PlexTrac's numeric scoring field
• CWE/References map to PlexTrac's references field, including a generated CWE definition link
• Affected URL, source tool, and vulnerability category map to affected assets, tags, and category

Each finding's status is set to "Open" so it enters PlexTrac's triage workflow. PlexTrac users can group TurboPentest findings alongside manual findings in the same report, then use PlexTrac's narrative editing to add custom context before delivering to clients.

Dradis Export

Dradis is an open-source collaboration and reporting platform popular with both consultancies and internal teams. It uses a project-based structure with issue templates.

TurboPentest exports to Dradis using its textile-based issue field format. Each finding becomes a Dradis issue with:

• Fields populated using Dradis field syntax: Title, Severity, Type, CVSSv3 Base Score, Description, Output, Solution, CWE, CVE, OWASP, Location, and Source
• Proof of exploit formatted as a textile code block in the Output field for proper rendering
• Location set to the finding's affected URL
• References including the TurboPentest report ID and any finding reference links

Dradis exports preserve the evidence chain - proof-of-exploit output is formatted as textile code blocks that render correctly in Dradis's report templates. Teams using Dradis Pro can import TurboPentest findings alongside output from other tools (Burp Suite, Nessus, OWASP ZAP) and use Dradis's combination features to merge duplicates and build unified reports.

AttackForge Export

AttackForge is a pentest management platform focused on enterprise workflows, offering project management, vulnerability tracking, SLA monitoring, and client self-service portals.

TurboPentest exports to AttackForge using its JSON import schema. The mapping includes:

• Vulnerability details - Title, priority (severity), and a likelihood-of-exploitation rating derived from the CVSS score
• Attack details - Description, attack scenario, and steps to reproduce drawn from the proof of exploit
• Affected assets - The affected URL or target
• Remediation guidance - The remediation recommendation field
• Notes and custom fields - Reference links, the finding's continuity status, CVSS score and vector, CWE ID, and OWASP/SANS categories
• Import metadata - Import source "TurboPentest" and the report ID, with instructions for AttackForge's bulk vulnerability import API

AttackForge's strength is its project lifecycle management. Once TurboPentest findings are imported, AttackForge tracks them through states such as Open, In Remediation, Ready for Retest, and Fixed. The continuity status included with each finding helps teams running repeat pentests triage which findings are new and which persist.

Ghostwriter Export

Ghostwriter is an open-source reporting tool built specifically for offensive security teams. Developed by SpecterOps, it excels at collaborative report writing with activity tracking, finding libraries, and customizable report templates.

TurboPentest exports to Ghostwriter using its JSON finding format:

• Finding - Title, severity, CVSS score and vector, description, impact, and replication steps
• Finding type - Automatically classified as Web Application, Network, or Cloud based on the vulnerability type
• Affected entities - The affected URL or target domain
• References - Generated CWE definition and NVD CVE links plus finding reference links
• Extra fields - Source tool, vulnerability type, CWE ID, OWASP/SANS categories, continuity status, and the TurboPentest report ID
• Import instructions - Each finding is shaped for Ghostwriter's reported-finding GraphQL mutation

Ghostwriter's collaborative workflow means multiple consultants can review and refine TurboPentest's AI-generated findings before they become part of the final report. The activity log tracks every edit, providing an audit trail of human review applied to automated findings.

Choosing the Right Export

Each platform serves different organizational needs:

The Dradis, AttackForge, and Ghostwriter exports embed the TurboPentest report ID, and the AttackForge and Ghostwriter exports carry each finding's continuity status - so repeat-pentest trends remain traceable in the platform that manages the findings long-term.

Export Access

Exports are generated on-demand from the pentest detail page. Each export format is available alongside the PDF download. The export uses the same data as the PDF report - findings, evidence, and remediation guidance - reformatted for the target platform's schema.