Nettacker - Automated Penetration Testing Framework - Open-Sou

项目说明

OWASP Nettacker
=========
![Build Status]()
![Apache License]()
![Twitter]()
!GitHub contributors
![Documentation Status]()
![Ask DeepWiki]()
![repo size ]()
![Docker Pulls]()

<img src=" width="200"><img src=" width="500">

DISCLAIMER

* *THIS SOFTWARE WAS CREATED FOR AUTOMATED PENETRATION TESTING AND INFORMATION GATHERING. YOU MUST USE THIS SOFTWARE IN A RESPONSIBLE AND ETHICAL MANNER. DO NOT TARGET SYSTEMS OR APPLICATIONS WITHOUT OBTAINING PERMISSIONS OR CONSENT FROM THE SYSTEM OWNERS OR ADMINISTRATORS. CONTRIBUTORS WILL NOT BE RESPONSIBLE FOR ANY ILLEGAL USAGE.*

!2018-01-19_0-45-07

OWASP Nettacker is an open-source, Python-based automated penetration testing and information-gathering framework designed to help cyber security professionals and ethical hackers perform reconnaissance, assessments, and network security audits efficiently. Nettacker automates tasks like port scanning, service detection, subdomain enumeration, network mapping, scanning, credential brute-force testing making it a powerful tool for identifying weaknesses in networks, web applications, IoT devices and APIs.

Key Features

Modular architecture - Each task — like port scanning, directory discovery, subdomain enumeration, checks, or credential brute-forcing - is implemented as its own module, giving you control over what runs.

Multi-protocol & multithreaded scanning - Supports HTTP/HTTPS, FTP, SSH, SMB, SMTP, ICMP, TELNET, XML-RPC, and can run scans in parallel for speed.

Comprehensi - Export reports in HTML, JSON, CSV, and plain text.

Built-in database & drift detection - Stores past scans in the database for easy search and comparison with current results: useful to detect new hosts, open ports, or in CI/CD pipelines.

CLI, REST API & Web UI - Offers both programmatic integration and a user-friendly web interface for defining scans and results.

E techniques - Enables configurable delays, proxy support, and randomized user-agents to reduce detection by firewalls or IDS systems.

Flexible targets - Accepts single IPv4s, IP ranges, CIDR blocks, domain names, and full HTTP/HTTPS URLs. Targets can be mixed in a single command or loaded from a file using the -l/--targets-list flag.

Use Cases

Penetration Testing

Automate reconnaissance, misconfiguration checks, service discovery, and scanning to support efficient and repeatable penetration testing workflows.

Recon & Assessment

Map li, open ports, services, default credentials, and directories, then perform credential brute-forcing or fuzzing using built-in or custom wordlists.

Attack Surface Mapping

Disco hosts, ports, subdomains, and services quickly using built-in enumeration modules—ideal for both internal and external assets.

Bug Bounty Recon

Automate and scale common reconnaissance tasks like subdomain enumeration, directory brute-forcing, and default credential checks to speed up finding targets.

Network Scanning

Efficiently scan IPs, IP ranges, or entire CIDR blocks or all subdomains of the organisation in parallel using a modular, multithreaded approach for large-scale network assessments.

Shadow IT & Asset Discovery

Use historical scan data and drift detection to unco or forgotten hosts, open ports/services, and subdomains appearing over time.

CI/CD & Compliance Monitoring

Integrate Nettacker into pipelines to track infrastructure changes and detect new scan history and comparison features.

Links

* OWASP Nettacker Project Home Page:
* Documentation:
* Slack: #project-nettacker on
* Installation:
* Usage:
* GitHub repo:
* Docker Image:
* How to use the Dockerfile:
* OpenHub:
* Donate:
* Read More:

____________
Quick Setup & Run
============

CLI (Docker)

Web UI (Docker)

* Use the API Key displayed in the CLI to login to the Web GUI
* Web GUI is accessible from your () or (pointed to your localhost)
* The local database is .nettacker/data/nettacker.db (sqlite).
* Default results path is .nettacker/data/results
* docker-compose will share your nettacker folder, so you will not lose any data after docker-compose down
* To see the API key in you can also run docker logs nettacker_nettacker.
* More details and install without docker
_____________
Thanks to our awesome contributors!
============

OWASP Nettacker is an open-source project, built on the principles of collaboration and shared knowledge. The OWASP community contributes to its de, ensuring that the tool remains up-to-date, adaptable, and aligned with the latest security practices. Thanks to all our awesome contributors! 🚀

!Awesome Contributors

Adopters

We’re grateful to the organizations, community projects, and indi who adopt and rely on OWASP Nettacker for their security workflows.

If you’re using OWASP Nettacker in your organization or project, we’d love to hear from you! Feel free to add your details to the ADOPTERS.md file by submitting a pull request or reach out to us issues. Let’s showcase how Nettacker is making a difference in the security community!

See ADOPTERS.md for details.

_____________

*Google Summer of Code (GSoC) Project*

* ☀️ OWASP Nettacker Project is participating in the Google Summer of Code Initiative
* 🙏 Thanks to Google Summer of Code Initiative and all the students who contributed to this project during their summer breaks:

<a href=" src=" width="200"></img></a>

_____________

Supporters

OWASP Nettacker is supported by Sorena AI, a compliance and GRC platform that helps security teams streamline assessments, e collection, risk management, and regulatory workflows.

项目信息

开发语言：Python

Star 数：5638

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。