Automated Security Testing with OWASP Nettacker

Nettacker: An Automated Penetration Testing Framework

• Nettacker is a free and open-source automated reconnaissance and penetration testing tool
• It can scan networks for vulnerabilities, discover expired SSL certificates, and find subdomains hosting vulnerable versions of content management systems
• Nettacker can be used by both attackers and defenders, and has been helpful for bug bounty research
• The tool uses YAML modules and is written in Python
• Nettacker can be automated using GitHub actions and Docker containers
• Automated scans can be scheduled to run regularly and generate reports as artifacts

The speaker demonstrated how Nettacker can be used to scan a network and generate a spreadsheet of all assets and vulnerabilities. He also showed how the tool can be automated using GitHub actions to perform regular scans and generate reports as artifacts.

OWASP Nettacker project (a portmanteau of "Network Attacker") is a relatively new yet an awesome and powerful 'swiss-army-knife' automated penetration testing framework fully written in Python. Nettacker recently gained a lot of interest from the European and Asian penetration testing communities and was even included in the specialist Linux distribution for penetration testers and security researchers. Nettacker is able to run various scans using a variety of methods and generate scan reports for applications and networks, including services, bugs, vulnerabilities, misconfigurations, default credentials and many other cool features - for example an ability to chain different scan methods. This talk will feature a live demo and several practical usage examples of how organisations can benefit from this OWASP project for automated security testing