# Nettacker: Automate Penetration Testing and Network Reconnaissance

This repository profile is provided by osrepos.com, an open source repository discovery platform.

Source: osrepos.com
Repository profile: https://osrepos.com/repo/owasp-nettacker
Generated for open source discovery and AI-assisted research.

OWASP Nettacker is a Python-based framework for automated penetration testing and information gathering across networks, web applications, IoT devices, and APIs. It combines modular scans with a CLI, REST API, and web UI for security professionals and ethical hackers.

GitHub: https://github.com/owasp/nettacker
OSRepos URL: https://osrepos.com/repo/owasp-nettacker

## Summary

OWASP Nettacker is a Python-based framework for automated penetration testing and information gathering across networks, web applications, IoT devices, and APIs. It combines modular scans with a CLI, REST API, and web UI for security professionals and ethical hackers.

## Topics

- python
- security
- automation
- networking
- vulnerability-scanner
- penetration-testing
- network-recon

## Repository Information

Last analyzed by OSRepos: Sat Oct 24 2026 05:30:47 GMT+0100 (Western European Summer Time)
Detail views: 0
GitHub clicks: 0

## Safety Notice

OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything.

## Content

## Overview

OWASP Nettacker is a Python-based automated penetration testing and information-gathering framework. It helps security professionals and ethical hackers find exposed services and potential weaknesses across networks, web applications, IoT devices, and APIs through repeatable reconnaissance and vulnerability assessments.

Its modular scanners cover tasks such as port and service discovery, subdomain enumeration, and credential testing. Nettacker supports a CLI, REST API, and web UI, and stores scan history for comparing results over time. It is intended for authorized security work; its scans can include brute-force testing, so targets should only be tested with permission.

## Key Features

- Run modular checks for port scanning, service detection, subdomain enumeration, directory discovery, and vulnerabilities.
- Scan targets including IP addresses, CIDR ranges, domains, and HTTP/HTTPS URLs.
- Perform multithreaded scans across protocols including HTTP/HTTPS, FTP, SSH, SMB, SMTP, ICMP, and TELNET.
- Use a CLI, REST API, or web interface to configure and run scans.
- Export results as HTML, JSON, CSV, or plain text.
- Store previous scans and compare results to spot changes in hosts, ports, or findings.
- Configure delays, proxies, and randomized user agents as scanning options.

## Use Cases

- Penetration testers can automate reconnaissance and service checks before an authorized assessment.
- Security teams can map exposed hosts, ports, and subdomains across internal or external assets.
- Bug bounty researchers can automate common reconnaissance tasks against in-scope targets.
- Teams can compare stored scan results to identify changes in their infrastructure over time.

## Our Take
Nettacker is an actively maintained, Apache-2.0-licensed security framework with regular commits and releases, a broad contributor base, and ongoing issue and pull-request activity, but its intrusive scanning features require careful authorization and configuration.

**Good fit if:**
- You need a Python-based tool that combines reconnaissance, vulnerability checks, and credential testing in modular scans.
- You want CLI, API, or web UI access and the ability to compare stored scan results.
- You can run scans only against systems you own or have explicit permission to test.

**Look elsewhere if:**
- You need a narrowly scoped scanner without credential brute-force or other intrusive testing modules.
- You need a security tool with a license other than Apache-2.0.
- You need a workflow or platform that Nettacker does not document, such as Helm-based deployment.

## Project Health

| Signal | Value |
|---|---|
| Status | **Active**: regular commits and releases |
| Last commit | 2026-10-23 (today) |
| Commits, last 90 days | 41 |
| Releases, last 12 months | 1 (latest 0.4.1, 2026-08-24) |
| Contributors | 81 (top contributor: 27% of commits) |
| Issues closed, last 90 days | 20+ (typically closed in 4 days) |
| Pull requests merged, last 90 days | 33 (typically merged in 2 days) |
| Project age | 9 years |

Checked on 2026-10-24 with the GitHub API.

## Project Facts

- Language: Python
- License: Apache-2.0
- Stars: 5.7k
- Forks: 1.2k
- Topics: automation, bruteforce, cve, hacking-tools, information-gathering, network-security, owasp, penetration-testing
- Website: https://owasp.org/nettacker
- Archived: no

## What You Need

Detected in the repository:

- Python (from pyproject.toml)
- A Dockerfile, so it can run in a container; a Compose file sets up the related services
- A test suite and automated checks on GitHub Actions

## Getting Started

The README provides Docker setup and installation instructions. For a basic port scan, run:

```bash
docker run owasp/nettacker -i 192.168.0.1 -m port_scan
```

See the [README](https://github.com/OWASP/Nettacker) and [installation documentation](https://nettacker.readthedocs.io/en/latest/Installation) for more options.

## License in Plain Words

**Apache-2.0** (permissive).

- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license, the NOTICE file and a note of your changes
- Share your changes: no
- Includes an explicit patent grant from the contributors

A summary, not legal advice: the LICENSE file is what applies.

## Alternatives

- [mantis](https://osrepos.com/repo/phonepe-mantis): Mantis focuses on organization-wide attack-surface discovery and scans for secrets, misconfigurations, and phishing domains, while Nettacker emphasizes modular network and service testing.
- [hexstrike-ai](https://osrepos.com/repo/0x4m4-hexstrike-ai): HexStrike AI lets compatible agents orchestrate external security tools, whereas Nettacker provides its own modular scanning framework with a CLI, REST API, and web UI.

| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| **Nettacker** | Python | Apache-2.0 | 5.7k | Active |
| [mantis](https://osrepos.com/repo/phonepe-mantis) | Python | Apache-2.0 | 1k | Quiet |
| [hexstrike-ai](https://osrepos.com/repo/0x4m4-hexstrike-ai) | Python | MIT | 12.8k | Maintained |

## Considerations

Nettacker can perform brute-force testing and scans over broad target ranges, so incorrect target selection or aggressive settings can disrupt systems or exceed authorization. Its documented Docker setup uses a local SQLite database for scan history; Python is the listed runtime for non-Docker use. The project is active, with recent commits and releases, and contributions are not concentrated in a single person. Review Apache-2.0 terms when redistributing or incorporating it into another product.