- Home
- Vulnerability Scanning Software
- OWASP Nettacker
OWASP Nettacker
What it is
OWASP Nettacker is free, open-source software for automating information gathering, vulnerability scanning, and penetration testing. It can look for open ports, services, misconfigurations, default credentials, and subdomains across IPv4 addresses and ranges, IPv4 CIDR blocks, domains, and HTTP or HTTPS URLs. It can run as a command-line utility, Docker container, API, or Web GUI. Its modular design supports prebuilt and customizable scanning modules, and it generates reports in HTML, TXT, JSON, and CSV formats. The latest release also lists SARIF and DefectDojo-compatible reports, and the project supports Maltego transforms. Nettacker is written in Python and does not rely on launching external tools. Installation options include source installation with Poetry, PyPI through pip or pipx, and Docker. Native support covers Linux, macOS, and FreeBSD; Docker can be used on other operating systems, while native Windows support is in progress. The current installation guide supports Python 3.11–3.12. The project advises getting permission before targeting systems.
For and against
For
- Free, open-source software
- Offers command-line, Docker, API, and Web GUI options
- Produces reports in four listed formats
- Supports IPv4, domains, and HTTP or HTTPS targets
Against
- Native Windows support is still in progress
- Current guide supports Python 3.11–3.12
- Older versions may not receive security updates
The verdict
Nettacker offers several ways to run modular scans and produce reports, with native support for Linux, macOS, and FreeBSD. Check its Python and platform requirements, and scan only systems you are authorized to assess.
Who it suits
Nettacker is intended for cybersecurity professionals and ethical hackers conducting reconnaissance, vulnerability assessments, and network security audits. Users should have permission or consent from system owners or administrators before scanning.
Plans and prices
OWASP Nettacker
Open-source software · Apache License 2.0
Read 4 Oct 2026 · owasp.org
On the record
- Authorization
- The repository warns users to obtain permission or consent from system owners or administrators before targeting systems.github.com · read 4 Oct 2026
- Implementation
- The project says Nettacker is written entirely in Python and does not rely on launching external tools.owasp.org · read 4 Oct 2026
- Install options
- Documentation describes installation from source with Poetry, from PyPI with pip or pipx, and with Docker.nettacker.readthedocs.io · read 4 Oct 2026
- Integrations
- The latest release lists SARIF and DefectDojo-compatible reports, and the project supports Maltego transforms.owasp.github.io · read 4 Oct 2026
- Intended users
- The project describes its intended users as cybersecurity professionals and ethical hackers conducting reconnaissance, vulnerability assessments, and network security audits.owasp.org · read 4 Oct 2026
- Interfaces
- Can run as a command-line utility, Docker container, API, or Web GUI.owasp.org · read 4 Oct 2026
- Platform support
- Natively supports Linux, macOS, and FreeBSD; users of other operating systems can use Docker, and native Windows support is being worked on.nettacker.readthedocs.io · read 4 Oct 2026
- Purpose
- Automates information gathering, vulnerability scanning, and penetration testing, including discovery of open ports, services, misconfigurations, default credentials, and subdomains.owasp.org · read 4 Oct 2026
- Reports
- Generates scan reports in HTML, TXT, JSON, and CSV formats.owasp.org · read 4 Oct 2026
- Runtime requirement
- The installation guide currently supports Python 3.11–3.12 and says compatibility with later Python versions is in progress.nettacker.readthedocs.io · read 4 Oct 2026
- Scanning
- Its modular architecture supports prebuilt and customizable modules for different scanning tasks.owasp.org · read 4 Oct 2026
- Security policy
- The project provides security updates for the latest stable release and current master branch, while older versions may not receive updates.github.com · read 4 Oct 2026
- Support
- The security policy points users to GitHub Issues and the OWASP Slack #project-nettacker channel for general inquiries.github.com · read 4 Oct 2026
- Vulnerability reporting
- The security policy directs vulnerability reports through a private GitHub Security Advisory and describes a responsible disclosure process.github.com · read 4 Oct 2026
