# OWASP/Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Repository: https://github.com/OWASP/Nettacker
Canonical: https://ross.abutalabs.com/products/nettacker
Homepage: https://owasp.org/nettacker
Language: Python
License: Apache-2.0
License Family: permissive
Topics: python, penetration-testing, penetration-testing-framework, owasp, automation, portscanner, vulnerability-scanners, information-gathering, bruteforce, security, security-tools, scanner, pentesting, cve, hacking-tools, pentesting-tools, vulnerability-scanner, vulnerability-management, network-security, recon
Last push: 2026-08-25T17:41:57+00:00

## Health v2 (maintenance only)
Score: 88/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 67, longevity 100
- inputs: {"age_days": 3421, "days_push": 8, "days_rel": 9, "gap_med": 696, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 5535, forks 1156 (observed 2026-08-28T04:09:22.031793+00:00)

## What it is
OWASP Nettacker is a Python-based automated penetration testing and information-gathering framework for reconnaissance, vulnerability scanning, and network security audits. It offers modular scans (port scanning, service detection, subdomain enumeration, brute-forcing) via CLI, REST API, and Web UI, with reports in HTML, JSON, CSV, and text.

## Use cases
- scan a network for open ports and running services
- enumerate subdomains of a target domain
- brute-force credentials on SSH, FTP, or SMTP services
- run automated vulnerability assessments against web applications and APIs
- audit IoT devices for known CVEs
- detect new hosts or open ports by comparing scans over time
- generate pentest reports in HTML or JSON

## When to choose
- you need an all-in-one automated recon and vulnerability scanning framework
- you want CLI, REST API, and Web UI access to scanning capabilities
- you need multi-protocol scanning (HTTP, SSH, SMB, FTP, SMTP, ICMP) with parallel execution
- you want scan history stored in a database for drift detection in CI/CD

## When to avoid
- you need a deep manual exploitation framework like Metasploit
- you only need a single-purpose fast port scanner like nmap
- you lack authorization to test the target systems
- you need a GUI-only vulnerability management platform

## Facets
- artifact type: cli-tool
- maturity: active
- function: penetration-testing, vulnerability-scanning, security, web-scraping, cli, api-framework, http-client
- domain: security, penetration-testing, networking, iot
- platform: python, windows, cli
- tags: port-scanner, recon, bruteforce, subdomain-enumeration, vulnerability-management, owasp, cve, information-gathering, rest-api, web-ui, linux, macos, docker, web-server

## Member repositories
- OWASP/Nettacker (main) score 88

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:22.031793+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:55:43.910793+00:00, confidence not recorded.
  - readme: https://github.com/OWASP/Nettacker (fetched 2026-08-28T04:09:22.031793+00:00, sha 67c56e4f9792)
  - homepage: https://owasp.org/nettacker (fetched 2026-08-29T08:51:03.712021+00:00, sha 13d04ca15538)
  - registry_pypi: https://pypi.org/pypi/nettacker/json (fetched 2026-08-29T08:51:03.714334+00:00, sha 9de9b23812d5)
- Data as of 2026-08-30T08:39:29.467469+00:00.