OWASP/Nettacker

Features

• Network Vulnerability Scanning - Performs comprehensive scanning of network assets to identify security weaknesses and misconfigurations across infrastructure.
• Reconnaissance Workflow Orchestrators - Orchestrates the full sequence of reconnaissance, port scanning, and vulnerability detection into an automated workflow.
• Penetration Testing Frameworks - Provides a complete software environment to automate the discovery and exploitation of network security weaknesses.
• Web Application Crawlers - Combines automated web crawling and input fuzzing to discover hidden paths and vulnerabilities in web applications.
• Network Device Discovery - Maps the attack surface by discovering active devices, open ports, and subdomains across target networks.
• Penetration Testing - Provides a comprehensive framework for conducting automated penetration testing through orchestrated reconnaissance and scanning.
• Audit Result Persistence - Includes an internal database for persisting security audit findings and metadata for compliance tracking.
• Relational Database Persistence - Uses relational databases to persist historical scan results and configurations for long-term tracking.
• Recursive Crawl Discoverers - Automatically discovers application endpoints and hidden paths using recursive crawling and input fuzzing.
• Attack Surface Mapping - Maps internet-facing assets and hidden subdomains to identify and document organizational exposure.
• External Asset Discovery - Discovers external-facing domains, IPs, and subdomains to map the external footprint of a target.
• Target-Agnostic Scanning - Supports a wide variety of target inputs including IP ranges, CIDR blocks, and domains for flexible network probing.
• Network Security Auditing - Audits network services and server configurations for misconfigurations, outdated patches, and weak credentials.
• Reconnaissance Workflow Automation - Automates the sequence of subdomain enumeration and vulnerability scanning to gather target intelligence.
• Network Vulnerability Databases - Checks targets against comprehensive databases of known security flaws and common vulnerabilities.
• Vulnerability Scanners - Implements automated tools to identify open ports, fingerprint services, and detect known security flaws in infrastructure.
• Service Fingerprinting - Uses a detection engine to identify specific software versions and server banners via network probes.
• Subdomain Enumeration Tools - Provides utilities for enumerating and discovering subdomains to expand the analysis surface area.
• Network Reconnaissance Tools - Ships a suite for scanning networks to identify active services and map the target attack surface.
• Vulnerability Scanning Workflows - Implements a workflow for scanning known security flaws and persisting results for remediation tracking.
• Offline Vulnerability Analysis - Analyzes network services and device configurations against known bugs and security weaknesses.
• Scanning Module Systems - Organizes vulnerability tests into discrete, interchangeable modules that can be grouped into targeted scan profiles.
• Scan Management APIs - Ships a RESTful API for triggering on-demand security scans and managing scan records.
• Security Scanning Integrations - Connects automated security scans into CI/CD pipelines via a programmatic interface.
• Scan Configuration Profiles - Provides a system for grouping scanning modules into reusable profiles for standardized security audits.
• Multi-Format Target Scanning - Accepts IP ranges, CIDR blocks, and domain names as input to perform scans across multiple targets.
• Multi-Format Vulnerability Reports - Generates security scan reports in multiple formats including HTML, JSON, and SARIF for stakeholder review.
• Multi-Protocol Vulnerability Scanning - Provides a probe capable of assessing diverse protocols for system vulnerabilities.
• Web Application Fuzzers - Provides an active execution engine that generates HTTP inputs to discover vulnerabilities and hidden paths in web applications.
• Credential Brute-Forcing - Provides a systematic tool for testing common login combinations to identify unauthorized access vulnerabilities.
• Vulnerability Management Systems - Includes a centralized platform to persist scan results in a database and track historical security assessments.
• CI Pipeline Integration - Provides a programmatic interface to integrate automated vulnerability scans directly into CI build processes.
• Device Discovery Engines - Implements a network scanning tool that identifies active devices and services across a target network.
• Automated Security Scan Triggers - Provides a mechanism to automatically trigger vulnerability assessments using defined modules and custom arguments.
• Web Crawlers - Provides an automated tool to discover application endpoints and map the structure of web applications through crawling.
• Security Configuration Auditing - Inspects server settings and HTTP headers to identify security misconfigurations and missing security headers.
• Remote Control Interfaces - Exposes a programmatic interface for remote control and management of security scanning processes.
• Application Security - Automated penetration testing and vulnerability scanning framework.
• Vulnerability Scanning and Auditing - Automated information gathering and vulnerability scanning.

Star history