AI
The Network Visibility Problem
Four recent breaches frame the talk: Moveit (60 million individuals affected), Citrix Bleed (governments, pharma, and banks all hit), Ivanti VPN (widespread enterprise exposure), and CrashFTP (SFTP transfers exploited earlier that year). Each incident raises the same three questions: do you know which of these technologies run in your network, how many instances exist, and have they been patched? OWASP Nettacker is a free, open-source tool built to answer all three.
Three Module Types, Pure Python
Nettacker ranks sixth on OWASP GitHub by starred repositories. Written in 100% Python, it depends on no external tools. No Nmap, no Metasploit. Three module types cover all recon and assessment work: scan (port enumeration, subdomain discovery, CMS detection), vuln (CVE checks for Citrix, Apache Struts, Microsoft Exchange, expired SSL certs, server version leaks), and brute (credential testing over FTP, SSH, SMTP, Telnet, HTTP forms, WordPress XML-RPC, and SMB). Modules bundle into named profiles so testers skip memorizing individual flags.
One Command Scanning Thousands of Targets
Burp Suite and ZAP scan one website for many vulnerability types. Nettacker works the inverse: one or a few module checks across thousands of targets at once. Targets can be a single IP, a CIDR range (/24 covers 256 hosts, /16 covers 65,000), all subdomains of a domain, or a text file of networks. In one real engagement, a London bank’s entire network scanned for default credentials found several dozen cameras using admin/admin in minutes.
Parallel Modules and What They Reveal
Against owasp.org, Nettacker scanned 100+ subdomains with two modules running in parallel. Server version and X-Powered-By checks found two exposures: OWASP Nest leaking that it runs Next.js, and a server exposing Nginx 1.29.3. Adding a port scan module turned up one host with port 22 open running OpenSSH 9. The full scan ran from a single command combining subdomain enumeration with two vulnerability checks across the entire organization infrastructure.
Outputs, Automation, and AI Integration
Nettacker generates HTML, JSON, and CSV output. The CSV exports every server, open port, brute-force result, and expiring certificate across an entire network into a filterable spreadsheet. A scan comparison feature logs what changed since the last run: new hosts, new open ports, new vulnerabilities. The project received an OpenAI grant to build AI-assisted analysis. The PyPI package passed 20,000 downloads. A new SSL module checking for post-quantum cipher support is in development.
Notable Quotes
people affected 60 million individuals Sam Stepanyan · ▶ 1:04
Netacker is an offensive security tool. Sam Stepanyan · ▶ 14:58
Go and attack your own network Arkadii Yakovets · ▶ 32:17
Key Takeaways
- Nettacker scans hundreds of thousands of hosts at once using CIDR notation, a domain, or a target file.
- Three module types (scan, vuln, brute) cover port discovery, CVE checks, and credential testing in pure Python.
- Scan comparison mode shows new hosts, ports, and vulnerabilities since the last run, making continuous monitoring practical.
About the Speaker(s)
Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 20 years of experience in IT. His background spans software engineering and web application development, with extensive work across financial services institutions. He also serves as a member of the OWASP Global Board.
Arkadii Yakovets is a cybersecurity lead specializing in secure application development and DevSecOps. Since joining OWASP in 2023, he has served as a leader and active contributor to both OWASP Nest and OWASP Nettacker. He has mentored over 10 students through Google Summer of Code.