Automated Security Testing with OWASP Nettacker

The talk introduces OWASP Nettacker, a free, open-source penetration testing framework written entirely in Python. The speaker opens with recent edge-device vulnerabilities to show how many organisations struggle to inventory the exposed systems they run. Nettacker accepts single addresses, IP ranges, CIDR blocks, domains and URL lists, and can enumerate subdomains first. Its modules cover scanning, vulnerability checks and brute forcing, and several can be chained in one run.

The live demo covered port scans, subdomain discovery and HTTP title and server-version checks. Every result is saved to a built-in database and can be viewed as an HTML report, through a web interface or API, or exported to CSV for inventories. Scan comparison against a baseline flags new hosts, unusual ports, new findings and expiring certificates. Colour coding separates passive checks from modules that send attack payloads or brute-force credentials.

The closing advice is to get permission before scanning any network, because the tool is offensive by design. It installs through Docker or pip and fits into pipelines such as GitHub Actions. Teams can write custom YAML modules, for example to confirm that a pentest finding has been fixed without paying for a retest. The speaker contrasts it with Burp Suite and ZAP, which target one website, and with Nuclei, which needs a URL list.