AI
Recent Exploits and the Asset Discovery Gap
MOVEit affected more than 60 million individuals in the US after personal data was stolen. Citrix Bleed bypassed MFA entirely, letting attackers log directly into networks. Days before this session, CISA issued a patch deadline for Ivanti Cloud Security Appliance, threatening disconnection for government agencies that missed it. A critical Pulse VTM vulnerability dropped the day before. The question behind all four: do you know whether any of these devices exist in your network, and have they been patched?
OWASP Nettacker: 100% Python, No External Dependencies
Nettacker is written entirely in Python with no third-party tool dependencies, no nmap, no gobuster. That design choice means it runs on anything Python runs on. Modules split into three types: scan (port discovery), vuln (specific CVEs like Apache Struts), and brute (credential stuffing). The project started as an IoT scanner. It now has over 100 modules, supports 25 languages, and lets users bundle modules into named profiles for repeatable scan patterns.
Scanning Targets From a Single IP to an Organization
Nettacker takes two core parameters: -i for the target and -m for the module. A target can be a single IP, a /24 subnet (256 addresses), a domain and all its subdomains, or a text file listing thousands of targets. In the live demo, scanning owasp.org with the HTML title and X-Powered-By modules discovered a subdomain running PHP 8.3.3, Jira at contact.owasp.org, and Sourcegraph, all in one pass. Modules chain: port scan, PHP admin scan, and directory brute force run simultaneously.
Persistent Scan Results and Asset Inventory Reports
Every Nettacker scan writes to a built-in SQLite database, so results accumulate across sessions rather than disappearing. Reports export as HTML (with a graph view showing all scanned subdomains and findings), JSON, and CSV. The CSV output lets you filter by technology stack, software version, or open port across thousands of hosts. In one real engagement, Nettacker found outdated MOVEit Transfer versions on a customer’s network when commercial tools missed them. A GitHub Action packages this into CI/CD pipelines.
v0.4 and the Refactor That Made It Possible
Arkadii Yakovets joined OWASP less than a year before this session and found a codebase with zero test coverage, function-level imports instead of module-level, and widespread exception handling misuse. Most contributors had been Google Summer of Code students writing functional Python without OOP. Yakovets refactored the base while maintaining backward compatibility. The result, v0.4, published 25 minutes before the session, ships on PyPI and Docker Hub for the first time. The pip install Sam demonstrated was not available before this release.
Notable Quotes
which had admin SL admin admin as a user Sam Stepanyan · ▶ Watch (8:56)
know what you own you cannot possibly Sam Stepanyan · ▶ Watch (18:45)
uh having zero test coverage was most uh Arkadii Yakovets · ▶ Watch (29:47)
Key Takeaways
- Nettacker scans entire IP ranges, domains, and subdomains simultaneously using 100+ pure Python modules.
- Chained module scanning combines port discovery, vulnerability checks, and brute force in one command.
- All scan results persist in SQLite and export as CSV for organization-wide asset inventory.
- v0.4 ships on PyPI and Docker Hub, making pip install available for the first time.
About the Speaker(s)
Sam Stepanyan is an OWASP London Chapter Leader (one of three) since 2015 and one of seven OWASP board members. With over 20 years in IT, his background spans software engineering and web application development. He works as an application security consultant for financial services institutions in London.
Arkadii Yakovets is a cybersecurity lead specializing in secure application development and DevSecOps. He joined OWASP in 2023 and serves as a leader and active contributor to both OWASP Nest and OWASP Nettacker. He has mentored over 10 students through Google Summer of Code and maintains the Python library “holidays,” which receives around 8 million downloads per month.