Ghostwriter: Open Source Business Intelligence & Reporting

What is Ghostwriter?

What it is

Ghostwriter is open-source Python project management and reporting engine for offensive security work. It lives in information security, penetration testing, red team ecosystem. Category: Data & Analytics, Business Intelligence & Reporting. Stack: Python 3.13, Django 5.2. Topics: informationsecurity, penetration-testing, red-team, reporting.

Problem solved: scattered assessment data. Red teams, consultants must track clients, projects, findings, domains, servers, evidence, report templates while producing deliverables. Ghostwriter centralizes data, feeds reporting engine, cuts manual report writing, improves collaborative documentation.

Key capabilities

Manages clients, projects, assessments, findings, evidence files, domains, infrastructure assets in one database-backed platform.
Creates reusable findings library, supports customized report templates for repeated offensive security reporting work.
Generates Word DOCX reports with Jinja2 templating, also produces XLSX, PPTX, JSON report formats.
Provides collaborative writing features for teams producing polished deliverables from shared assessment data.
Includes role-based access controls, single sign-on authentication, multi-factor authentication for controlled team access.
Integrates with Mythic C2, Cobalt Strike to enable automatic activity logging during assessments.
Exposes GraphQL API for custom project management, reporting workflows, external tool integrations.

Who uses it and how

Red teams use it as centralized environment to plan, execute, document offensive security assessments.
Consultants use it to track client, project information, covert infrastructure assets, finding templates, report templates, evidence files.
Teams use reporting engine to turn stored assessment data into DOCX, XLSX, PPTX, JSON deliverables.
Operations teams connect Mythic C2, Cobalt Strike activity logs into platform to reduce manual logging.
Developers use GraphQL API to build custom project management, reporting workflows around Ghostwriter data.
Support workflow: users discuss questions in BloodHound Slack #ghostwriter channel.

Getting started

README points to Ghostwriter Wiki for installation, setup information, covering first-time user setup through database schemas, code style guide, customization. No hosted option, package manager, Docker image name listed in supplied facts.

When to use it — and when not to

Use Ghostwriter when offensive security team needs self-hosted, open-source platform for assessment tracking, reporting, especially DOCX report generation, C2 activity logging. Supplied facts do not name paid products it replaces, so no direct comparison available. Self-hoster must follow Wiki for setup, operate platform without hosted option given; 38 open issues, no listed contributor count, repository age 7 years, last push 2026-09-14T21:49:14Z suggest review maintenance status before adoption.

project readme (upstream, from github) — read inline

Ghostwriter

GitHub Release (Latest by Date) GitHub Release Date

Ghostwriter is an open-source platform designed to enhance offensive security operations by simplifying report writing, asset tracking, and assessment management. It offers tools for managing clients, creating a reusable findings library, and organizing the infrastructure and domains utilized during assessments. With its powerful reporting engine, Ghostwriter includes comprehensive collaborative writing features and customizable report templates, allowing teams to produce polished deliverables with minimal manual effort.

Ghostwriter comes equipped with "enterprise-level" features, such as role-based access controls, single sign-on authentication, and multi-factor authentication. Additionally, it integrates with tools like Mythic C2 and Cobalt Strike to enable automatic activity logging. These capabilities make Ghostwriter an ideal centralized and collaborative environment for red teams and consultants to efficiently plan, execute, and document their assessments.

The platform effectively tracks and manages client and project information, covert infrastructure assets (such as servers and domain names), finding templates, report templates, evidence files, and more.

This data is accessible to Ghostwriter's reporting engine, which generates comprehensive Word (DOCX) reports using Jinja2 templating and your customized report templates. Ghostwriter can also produce reports in XLSX, PPTX, and JSON formats.

Furthermore, you can leverage Ghostwriter's GraphQL API to integrate custom project management, reporting workflows, and external tools into the platform.

Details

Check out the introductory blogpost: Introducing Ghostwriter

This blogpost discusses the design and intent behind Ghostwriter: Introducing Ghostwriter: Part 2

Documentation

The Ghostwriter Wiki contains everything you need to know to use or customize Ghostwriter.

The wiki covers everything from installation and setup information for first time users to database schemas, the project's code style guide, and how to expand or customize parts of the project to fit your needs.

Getting Help

The quickest way to get help is Slack. The BloodHound Slack Team has a #ghostwriter channel for discussing this project and requesting assistance. There is also a #reporting channel for discussing various topics related to writing and managing reports and findings.

You can submit an issue. If you do, please use the issue template and provide as much information as possible.

Before submitting an issue, review the Ghostwriter Wiki. Many of the common issues new users encounter stem from missing an installation step or an issue with Docker on their host system.

Contributing to the Project

The project team welcomes feedback, new ideas, and external contributions. Please open issues or submit a pull requests! Before submitting a PR, please check open and closed issues for any previous related discussion. Also, the proposed code must follow the Code Style Guide to be accepted.

We only ask you to limit PR submissions to those that fix a bug, enhance an existing feature, or add something new.

Contributions

The following people at SpecterOps have contributed much to this project:

These folks kindly submitted feedback and PRs to fix bugs and enhance existing features. Thank you!

Supporters

Ghostwriter's continuous development would not be possible without SpecterOps's commitment to transparency and support for open-source development.

Frequently asked questions

Is Ghostwriter free to use?

Ghostwriter is open source under the BSD-3-Clause licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Ghostwriter do?

The SpecterOps project management and reporting engine

What is Ghostwriter written in?

Ghostwriter is primarily written in Python. Its source is publicly available at https://github.com/GhostManager/Ghostwriter, and it has 1,916 GitHub stars.