Reporting Tools

cherrytree

cherrytree is a hierarchical note-taking application, and it’s a natural home for engagement notes. You organize everything into a tree of nodes — a node per host, per finding, per phase — with rich text, syntax-highlighted code and command output, embedded images and file attachments, and full-text search across the whole thing. Everything lives in a single document you can carry between machines. For the “where do I keep all of this while I work” problem, it’s a clean answer that many testers standardize on.

Cherrytree is a graphical application, launched into its own window from Security → Reporting Tools → cherrytree. Installed from the AUR.

The help it prints

[2026-09-02 16:54:53.609] [che] [warning] /home/cyberbow/.config/cherrytree/config.cfg missing
Usage:
  cherrytree [OPTION…]

Help Options:
  -h, --help                   Show help options
  --help-all                   Show all help options
  --help-gapplication          Show GApplication options
  --help-gtk                   Show GTK+ Options

Application Options:
  -V, --version                Print CherryTree version
  -n, --node                   Node name to focus
  -a, --anchor                 Anchor name to scroll to in node
  -x, --export_to_html_dir     Export to HTML at specified directory path
  -t, --export_to_txt_dir      Export to Text at specified directory path
  -p, --export_to_pdf_dir      Export to PDF at specified directory path
  -w, --export_overwrite       Overwrite if export path already exists
  -s, --export_single_file     Export to a single file (for HTML or TXT)
  -P, --password               Password to open document
  -N, --new_window             Create a new window
  -S, --secondary_session      Run in secondary session, independent from main session
  --display=DISPLAY            X display to use

Using it

A note tree for an engagement usually looks like:

Engagement
├── Scope & rules of engagement
├── Recon
│   ├── nmap output
│   └── OSINT findings
├── Hosts
│   ├── 10.0.0.5
│   │   ├── Services
│   │   ├── Credentials
│   │   └── Findings
│   └── 10.0.0.6
└── Report draft

Paste command output into code nodes (they keep monospace and highlighting), drag in screenshots, and use the search to find that one credential you noted three hours ago. Cherrytree exports to HTML and PDF when it’s time to turn notes into a deliverable.