nettacker
automated penetration testing framework
TLDR
SYNOPSIS
nettacker [-i targets | -l file] [-m modules | --profile name] [options]
DESCRIPTION
nettacker (OWASP Nettacker) is an automated penetration testing and information gathering framework. It performs port scanning, service detection, subdomain enumeration, vulnerability checks and credential brute forcing.Modules are YAML-defined and grouped by category, with names like portscan, sshbrute, httpstatusscan or wordpressversionscan. Profiles bundle related modules.Results are stored in a database, so past scans can be searched and compared to detect new hosts, ports or vulnerabilities (useful in CI pipelines). Reports can be HTML with D3 graphs, JSON, CSV or text.The --start-api option runs a REST API with a web interface for launching scans and browsing results.This tool is designed for authorized security assessments and penetration testing.
PARAMETERS
-i, --targets TARGETS
Comma-separated targets (IP, range, CIDR, hostname, URL).-l, --targets-list FILE
Read targets from a file.-m, --modules MODULES
Modules to run (comma-separated, or all).--profile PROFILES
Run all modules of the given profiles (e.g. scan, brute, vuln).-x, --exclude-modules MODULES
Modules to exclude.--show-all-modules, --show-all-profiles
List available modules or profiles.-g, --ports PORTS
Ports to scan (e.g. 22,80,1-1000).-X, --exclude-ports PORTS
Ports to exclude.-o, --output FILE
Report file; format follows the extension (.html, .json, .csv, otherwise text).--graph NAME
Graph for HTML reports (d3treev1graph, d3treev2graph).-t, --thread-per-host N
Number of concurrent connections per host.-M, --parallel-module-scan N
Number of modules to run in parallel.-T, --timeout SEC
Request timeout in seconds.-w, --time-sleep-between-requests SEC
Delay between requests.-u, --usernames USERS / -U, --users-list FILE
Usernames for brute force modules.-p, --passwords PASSWORDS / -P, --passwords-list FILE
Passwords for brute force modules.-W, --wordlist FILE
Wordlist for modules that read one (e.g. directory scanning).-r, --range
Scan the entire IP range of the target.-s, --sub-domains
Find and scan subdomains.-d, --skip-service-discovery
Skip service discovery and run modules directly.-H, --add-http-header HEADER
Add a custom HTTP header to requests.-R, --socks-proxy URL
Route traffic through a SOCKS proxy.--ping-before-scan
Ping hosts first and skip unresponsive ones.-K, --scan-compare ID
Compare current results with a previous scan.--start-api
Start the REST API and web UI (--api-host, --api-port, --api-access-key to configure).-L, --language LANG
Interface language.-v, --verbose
Verbose output.
CAVEATS
Only use with proper authorization. May trigger IDS/IPS alerts. Brute force can cause account lockouts. Some modules are intrusive. Commonly run via the owasp/nettacker Docker image, e.g. docker run owasp/nettacker -i target -m port_scan.
HISTORY
OWASP Nettacker was started by Ali Razmjoo in 2017 as an OWASP project. Version 0.4.0 restructured it into an installable Python package with a nettacker command, replacing the earlier python nettacker.py invocation.
SEE ALSO
nmap(1), metasploit(1), nikto(1), sqlmap(1), subfinder(1)
