Why Mass Scanning Matters

▶ Watch (7:30)

Nettacker fills a gap left by single-site scanners like Burp Suite and ZAP. Those tools crawl one domain for web vulnerabilities. Nettacker scans one or many targets — IP ranges, domain lists, or entire networks. Stepanyan showed a command that scanned owasp.org with three modules simultaneously: port scan, server version leak, and subdomain enumeration. The tool discovered 13 subdomains, including cloud.owasp.org (SSH on port 22, OpenSSH 8) and lists.owasp.org (OpenSSH 9). The built-in database kept every result searchable later.

Default Credentials and the 4,000 Camera Test

▶ Watch (38:10)

A major bank asked Stepanyan to find CCTV cameras installed with factory passwords. He ran Nettacker’s brute-force module with the credential pair “admin/admin” against 4,000 IP addresses. Seven cameras responded with the default login. “Hold my beer. I’m going to run the attacker,” he said. The tool produced a CSV spreadsheet of the findings. No other commercial scanner could match the speed of a single, multi-threaded Python tool that handled all 4,000 hosts in one pass.

Web UI and Scan Comparison

▶ Watch (40:10)

Nettacker starts a Flask web server with --start-api. The web UI shows all past scans in a searchable table. Stepanyan searched for “port 22” and immediately found the two subdomains that responded. He also searched for “nginx” and found giving.owasp.org running Nginx 1.29.5. The scan comparison feature compares a new scan against a baseline. It highlights new open ports, new vulnerabilities, and new weak passwords. Stepanyan runs a GitHub Action every night against owasp.org and gets a delta report each morning.

Modules and Profiles

▶ Watch (31:50)

The tool bundles 120+ modules in four types: scan, vulnerability, brute-force, and info. Profiles group modules by task. The “http” profile runs all web-related scans — title, status code, missing security headers, and admin panel discovery. The “ssl” profile checks for self-signed and expired certificates. Stepanyan demonstrated the “all” profile but warned it could take hours. He also showed how to exclude common ports (80, 443) to find everything else running on a network.

Q&A

Notable Quotes

“attack your own network before the real attackers do” Sam Stepanyan · ▶ Watch (52:59)

“the biggest application security risks are websites that you don’t know that you own” Sam Stepanyan · ▶ Watch (47:01)

“Hold my beer. I’m going to run the attacker.” Sam Stepanyan · ▶ Watch (38:38)

“we were one of the first scanners out there on the internet even before some of the commercial scanners offered the module to scan it.” Sam Stepanyan · ▶ Watch (51:01)

Key Takeaways

  • Nettacker scans entire networks, not single websites, and stores results in a built-in database.
  • The tool found seven IoT cameras with default credentials out of 4,000 in one pass.
  • Scan comparison detects new assets, open ports, and vulnerabilities automatically.

About the Speaker

Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 20 years of experience in IT industry with a background in software engineering and web application development. Sam has worked for various financial services institutions in the City of London specialising in Application Security consulting, Secure Software Development Lifecycle (SDLC), developer training, source code reviews and vulnerability management. He is also a Subject Matter Expert in Web Application Firewalls (WAF) and SIEM systems. Sam holds a Master’s degree in Software Engineering and a CISSP certification.