Skip to content
SPECIFICTION
Get listed

OWASP Nettacker

owasp.github.io

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit owasp.github.io
Spec score 7.9 #12 of 35 in Vulnerability Scanning Software

What it is

OWASP Nettacker is free, open-source software for automating information gathering, vulnerability scanning, and penetration testing. It discovers open ports, services, misconfigurations, default credentials, and subdomains across IPv4 addresses, ranges, CIDR blocks, domains, and HTTP or HTTPS URLs. Users can run it as a command-line utility, Docker container, API, or Web GUI. A modular architecture provides prebuilt and customizable scanning modules. Reports are generated in HTML, TXT, JSON, and CSV, with the latest release listing SARIF and DefectDojo-compatible output; Maltego transforms are supported. Nettacker is written entirely in Python and does not launch external tools. Installation options include Poetry from source, pip or pipx from PyPI, and Docker. Native support covers Linux, macOS, and FreeBSD; Docker serves other operating systems while native Windows support is in progress. The installation guide currently supports Python 3.11–3.12, with later compatibility underway. Security updates cover the latest stable release and current master branch, while older versions may not receive updates. The project directs vulnerability reports through a private GitHub Security Advisory.

Spec sheet

Purpose
Automates information gathering, vulnerability scanning, and penetration testing, including discovery of open ports, services, misconfigurations, default credentials, and subdomains.Read 4 Oct 2026 · owasp.org
Intended users
The project describes its intended users as cybersecurity professionals and ethical hackers conducting reconnaissance, vulnerability assessments, and network security audits.Read 4 Oct 2026 · owasp.org
Integrations
The latest release lists SARIF and DefectDojo-compatible reports, and the project supports Maltego transforms.Read 4 Oct 2026 · owasp.github.io
Support
The security policy points users to GitHub Issues and the OWASP Slack #project-nettacker channel for general inquiries.Read 4 Oct 2026 · github.com
Authorization
The repository warns users to obtain permission or consent from system owners or administrators before targeting systems.Read 4 Oct 2026 · github.com
Implementation
The project says Nettacker is written entirely in Python and does not rely on launching external tools.Read 4 Oct 2026 · owasp.org
Install options
Documentation describes installation from source with Poetry, from PyPI with pip or pipx, and with Docker.Read 4 Oct 2026 · nettacker.readthedocs.io
Interfaces
Can run as a command-line utility, Docker container, API, or Web GUI.Read 4 Oct 2026 · owasp.org
Platform support
Natively supports Linux, macOS, and FreeBSD; users of other operating systems can use Docker, and native Windows support is being worked on.Read 4 Oct 2026 · nettacker.readthedocs.io
Reports
Generates scan reports in HTML, TXT, JSON, and CSV formats.Read 4 Oct 2026 · owasp.org
Runtime requirement
The installation guide currently supports Python 3.11–3.12 and says compatibility with later Python versions is in progress.Read 4 Oct 2026 · nettacker.readthedocs.io
Scanning
Its modular architecture supports prebuilt and customizable modules for different scanning tasks.Read 4 Oct 2026 · owasp.org
Security policy
The project provides security updates for the latest stable release and current master branch, while older versions may not receive updates.Read 4 Oct 2026 · github.com
Vulnerability reporting
The security policy directs vulnerability reports through a private GitHub Security Advisory and describes a responsible disclosure process.Read 4 Oct 2026 · github.com

Plans and prices

OWASP Nettacker Free Open-source software · Apache License 2.0 Read 4 Oct 2026 · owasp.org

Every OWASP Nettacker plan and price →

Strong points and limits

Strong points

  • Free Apache-licensed open-source software
  • Runs via CLI, Docker, API, or Web GUI
  • Supports customizable scanning modules
  • Exports HTML, TXT, JSON, and CSV reports
  • Authenticated scanning is supported

Limits

  • Native Windows support is still in progress
  • Installation currently supports Python 3.11–3.12
  • Older versions may not receive security updates
  • Authorization is required before targeting systems

Who it suits

It is intended for cybersecurity professionals and ethical hackers conducting reconnaissance, vulnerability assessments, and network security audits. Users should obtain permission from system owners before scanning targets.

Verdict

Nettacker offers flexible, self-hosted scanning with multiple interfaces, report formats, and modular tasks. Platform and Python-version limits, plus the need for explicit authorization, should guide deployment planning.

Where Specifiction places it

Alternatives to OWASP NettackerAll alternatives →