Server Overview

The RTFMv2 Server is a centralized web application that enables penetration testing teams to collaborate on engagements, manage findings, generate reports, and centralize data. Built with ASP.NET Core, it provides a secure, multi-user platform for managing the entire lifecycle of security assessments.

Key Features

Collaboration & Data Management

  • Session Management: Create and manage engagement sessions with multiple team members
  • Real-time Collaboration: Multiple users can work on the same session simultaneously
  • Host & Service Tracking: Centralized database of discovered hosts and services
  • Finding Management: Create, edit, and organize security findings with severity levels
  • User Management: Role-based access control and session permissions

Reporting & Export

  • PDF Report Generation: Professional penetration testing reports using QuestPDF
  • HTML Export: Export findings and data in HTML format
  • Customizable Templates: Configure finding sections and report structure
  • Bulk Export: Export all findings from a session at once

AI-Powered Features

  • AI Integration: Connect to OpenAI-compatible APIs for intelligent analysis
  • Automated Analysis: AI-assisted finding descriptions and recommendations
  • Report Enhancement: AI-powered report content generation

Security & Authentication

  • JWT Authentication: Secure API access with JSON Web Tokens
  • Cookie-based Auth: Session-based authentication for web interface
  • Identity Framework: Built on ASP.NET Core Identity for user management
  • TLS Support: HTTPS encryption with certificate management
  • Session Isolation: Users only see sessions they have permission to access

Interface Components

The server provides several key interfaces organized by function:

Module Purpose
Home Dashboard Overview and quick access to recent sessions
Session Management Create, edit, archive, and manage engagement sessions
Findings Document vulnerabilities and security issues
Hosts & Services Track discovered infrastructure
Reports Generate professional PDF and HTML reports
Admin Dashboard System administration, user management, and configuration
User Management Add/remove users and manage session permissions
Data Creator Import data from external sources

Core Functionality

Session Management

Sessions are the central organizing unit in RTFMv2 Server. Each session represents a penetration testing engagement:

  • Session States: Created, Started, Review, Completed
  • Session Details: Name, host/client, date ranges, and team members
  • Access Control: Users can only access sessions they've been granted permission to
  • Archive Capability: Archive completed sessions to keep workspace organized

Finding Management

The findings module allows teams to document security vulnerabilities:

  • Severity Levels: Critical, High, Medium, Low, Informational
  • Affected Hosts: Track which systems are impacted
  • Rich Content: Description, impact, recommendations, and remediation steps
  • Export Options: Individual or bulk export to HTML/PDF
  • Customizable Sections: Configure which sections appear in findings

Host & Service Tracking

Track discovered infrastructure throughout the engagement:

  • Host Details: IP addresses, hostnames, operating systems
  • Service Inventory: Ports, protocols, and identified services
  • Linked Findings: Associate vulnerabilities with specific hosts
  • Service-by-Host View: Organized view of discovered services

User & Permission Management

Administrator capabilities for managing the platform:

  • User Accounts: Create and manage user credentials
  • Session Permissions: Grant/revoke access to specific sessions
  • Role-based Access: Admin vs. standard user capabilities
  • Activity Logging: Track system usage and changes

Report Generation

Professional report creation for deliverables:

  • PDF Generation: High-quality PDF reports using QuestPDF library
  • HTML Export: Web-friendly export format
  • Customizable Templates: Configure report sections and structure
  • Finding Sections: Executive summary, technical details, recommendations, etc.
  • Bulk Export: Export all findings from a session in one operation

Getting Started

Initial Setup

On first run, the server will guide you through initial configuration:

  1. Create Admin Account: Set up the first administrative user
  2. Configure Database: SQLite by default, PostgreSQL optional
  3. SSL Certificates (Optional): Upload TLS certificates for HTTPS
  4. AI Configuration (Optional): Connect to OpenAI-compatible APIs

Creating Your First Session

  1. Navigate to Sessions from the main menu
  2. Click Create New Session
  3. Enter session details (name, host, dates)
  4. Add team members who should have access
  5. Click Create to initialize the session

Adding Findings

  1. Select a session from the Sessions list
  2. Click on Findings in the session details
  3. Click + New Finding
  4. Fill in finding details:
  5. Title and severity level
  6. Affected hosts
  7. Description and impact
  8. Recommendations and remediation
  9. Save the finding

Generating Reports

  1. Navigate to Findings for a session
  2. Click Export Findings dropdown
  3. Choose export format:
  4. HTML: Web-friendly format
  5. PDF: Professional report document
  6. Report will be generated and downloaded

Administration

User Management

Administrators can manage users through the Users interface:

  • View all registered users
  • Grant/revoke session access
  • Manage user permissions
  • Monitor user activity

Database Management

The Admin Dashboard provides database administration:

  • View database statistics
  • Backup and restore operations
  • Database maintenance tasks

System Logs

Monitor system activity through the logs interface:

  • Request logging
  • Authentication events
  • Error tracking
  • User activity monitoring

Certificate Management

Configure HTTPS certificates for secure communication:

  • Upload PFX/PEM certificates
  • Configure certificate paths
  • Test certificate validity

AI Configuration

Configure AI integration for intelligent features:

  • Set API endpoint URL
  • Configure API keys
  • Test connection
  • Select AI models

Finding Sections Configuration

Customize what sections appear in findings:

  • Executive Summary
  • Technical Details
  • Impact Assessment
  • Recommendations
  • Remediation Steps
  • References

System Requirements

  • Platform: Windows, Linux, or macOS
  • Runtime: .NET 8.0 or higher
  • Database: SQLite (included) or PostgreSQL
  • Memory: 2GB RAM minimum, 4GB recommended
  • Storage: Varies based on session data and uploaded files

Security Considerations

  • Change Default JWT Secret: Update the JWT signing key in production
  • Use HTTPS: Configure TLS certificates for production deployments
  • Regular Backups: Back up the database regularly
  • Access Control: Carefully manage user permissions and session access
  • Update Dependencies: Keep framework and libraries up to date

Configuration

Key configuration settings in appsettings.json:

  • Database Connection: Connection string configuration
  • JWT Settings: Issuer, audience, and signing key
  • AI Configuration: API endpoints and keys
  • File Upload Paths: Storage locations for uploaded files
  • Session Timeout: Configure session expiration

Integration Points

The server integrates with other RTFMv2 components:

  • RTFMv2 Console: Upload logs, commands, and data to server sessions
  • RTFMv2 GUI: Synchronize findings and session data
  • External Tools: Import data from scanners and security tools
  • AI Services: Connect to OpenAI or compatible APIs

Common Workflows

Team Collaboration Workflow

  1. Admin creates a new session for an engagement
  2. Admin grants access to team members
  3. Team members log in and access the shared session
  4. Each team member adds hosts, services, and findings
  5. Team reviews findings collaboratively
  6. Lead generates final report for client delivery

Data Import Workflow

  1. Run external security scanners (Nmap, Nessus, etc.)
  2. Use Data Creator to upload scan results
  3. Server parses and imports hosts/services
  4. Review imported data in Hosts/Services views
  5. Create findings based on discovered vulnerabilities

Report Generation Workflow

  1. Complete security testing and document all findings
  2. Review findings for accuracy and completeness
  3. Configure finding sections in Admin settings
  4. Generate PDF report from Findings page
  5. Review generated report
  6. Export and deliver to client

Troubleshooting

Cannot Access Server

  • Verify the server is running and listening on the correct port
  • Check firewall rules allow access to the port
  • Ensure HTTPS certificate is configured correctly (if using TLS)

Database Errors

  • Check database file permissions (SQLite)
  • Verify PostgreSQL connection string (if using PostgreSQL)
  • Ensure database migrations have been applied

Authentication Issues

  • Clear browser cookies and try again
  • Verify user account exists and is active
  • Check JWT configuration in appsettings.json
  • Ensure session timeout settings are appropriate

Report Generation Fails

  • Check QuestPDF license is configured (Community license is free)
  • Verify finding data is complete
  • Review system logs for specific error messages
  • Ensure sufficient disk space for temporary files

Next Steps

Explore related documentation:

Support & Resources

  • Documentation: Complete guides for all RTFMv2 components
  • Source Code: Available for customization and extension
  • Community: Share experiences and best practices with other users