OWASP Nettacker Project

### Overview In this presentation, OWASP Nettacker project co-leaders Sam and Arc introduce the OWASP Nettacker tool—an open-source automated penetration testing, reconnaissance, and vulnerability scanning framework written entirely in Python. Highlighting recent widespread incidents such as the MOVEit breach, Citrix Bleed, Ivanti vulnerabilities, and CrushFTP exposures, the speakers address a fundamental enterprise security challenge: knowing what assets exist across an organization's network, identifying whether they are vulnerable, and verifying whether patches have been applied. Unlike web application vulnerability scanners such as Burp Suite and OWASP ZAP, which thoroughly crawl single sites for application-layer flaws, Nettacker is designed to assess entire networks spanning hundreds, thousands, or tens of thousands of IP addresses, domains, and subdomains to detect open ports, configuration weaknesses, and specific Common Vulnerabilities and Exposures (CVEs).

### Key Topics - **Project Evolution and Adoption:** Originally initiated under the name OWASP IoT Scan to discover Internet of Things devices and test default credentials, the project was adopted by Sam after presenting it on behalf of the original authors at Black Hat Europe 2018. Developed largely through Google Summer of Code (GSoC) student contributions, Nettacker has grown into the sixth most popular repository on OWASP's GitHub. - **Architecture and Extensibility:** Nettacker relies solely on Python multi-threading with no external dependencies on tools like Nmap or Metasploit. Modules are authored in human-readable YAML, making it easy for external contributors to write checks without advanced software engineering skills. - **Asset Discovery and Attack Surface Management:** Emphasizing asset inventory as a critical defensive baseline, Nettacker maps unmanaged internet-facing systems, subdomain footprints (including integration with OWASP Amass), and exposed internal hosts.

### Technical Details Nettacker categorizes its functionality into three core module types: 1. **Scan Modules (`scan`):** Information gathering and discovery modules, such as port scanning, ICMP ping sweeps, subdomain discovery, CMS identification (WordPress, Joomla, Drupal), admin panel detection, directory brute forcing, and PHPMyAdmin (PMA) discovery. 2. **Vulnerability Modules (`vuln`):** Specific targeted vulnerability checks, including tests for Citrix, Microsoft Exchange CVEs, MOVEit Transfer vulnerabilities, Ivanti CVEs, server version banner disclosure (Apache, Nginx), `X-Powered-By` header leakage, and expired SSL certificates. It also supports querying API endpoints to retrieve the `last patch date` of software appliances. 3. **Brute Force Modules (`brute`):** Credential-testing modules across protocols including SSH, Telnet, FTP, HTTP Basic Auth, HTTP login forms, NTLM, SMTP, SMB, and WordPress XML-RPC.

Modules can be grouped into predefined or custom profiles (e.g., `info`, `scan`, `brute`, `vuln`, `ssl`, `wp`, `citrix`, `ivanti`). Target inputs are highly flexible, supporting single IP addresses, IP ranges, CIDR notation (such as /24 or /16), domains, individual URLs, or text files loaded via `-l`. Operational outputs include visual graphs, HTML, JSON, and CSV spreadsheets, alongside a built-in web UI triggered via `--start-api` and a scan comparison feature for diffing scans against baselines.

### Takeaways Nettacker offers a versatile, automatable solution for defenders and security auditors to run offensive reconnaissance against their own environments before malicious actors do. The project is distributed via Docker, PyPI, BlackArch Linux, and Striker App, supports Linux, macOS, and FreeBSD (with Windows support planned), and recently received an OpenAI open-source grant to incorporate AI capabilities. The project leaders encourage organizations to leverage its inventory and scanning features responsibly and invite community contributions in YAML and Python.