-
-
Notifications
You must be signed in to change notification settings - Fork 819
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
32d7d98
commit d876e87
Showing
3 changed files
with
130 additions
and
41 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,31 +1,41 @@ | ||
# OWASP Nettacker | ||
## Introduction | ||
|
||
### Table of contents sections are also visible in the sidebar (right). | ||
OWASP Nettacker is an automated penetration testing framework designed to help cyber security professionals and ethical hackers perform reconnaissance, vulnerability assessments, and network security audits efficiently. | ||
|
||
<img src="https://raw.githubusercontent.com/OWASP/Nettacker/master/nettacker/web/static/img/owasp-nettacker.png" width="200"><img src="https://raw.githubusercontent.com/OWASP/Nettacker/master/nettacker/web/static/img/owasp.png" width="500"> | ||
Nettacker automates information gathering, vulnerability scanning, and credential brute forcing tasks, making it a powerful tool for identifying weaknesses in networks, web applications, IoT devices and APIs. | ||
|
||
OWASP Nettacker is an open-source software written in Python language. OWASP Nettacker uses YAML files to define **modules** in a structured and human-readable format. | ||
|
||
- [Introduction](#introduction) | ||
* [Links](#links) | ||
- [Installation](Installation.md) | ||
- [Usage](Usage.md) | ||
OWASP Nettacker's modular architecture is one of its core strengths, allowing users to perform specific tasks by leveraging a range of pre-built and customizable modules. | ||
|
||
# Introduction | ||
By leveraging a modular framework, Nettacker supports multiple protocols and scanning methods, making it highly adaptable to various security testing scenarios. | ||
|
||
## Key Features | ||
|
||
OWASP Nettacker is open-source software written in Python language using **YAML-type** modules that let you automate penetration testing and Information Gathering. This software aims to have all security tests you can do in a network, such as vulnerability scan and management (with or without CVE), brute force attacks, misconfiguration, and more. The purpose of this project is to speed up internal and external security assessments. | ||
1. Multi-Protocol Support | ||
OWASP Nettacker can scan a wide range of protocols, including HTTP/HTTPS, FTP, SSH, SMTP, ICMP, TELNET, XML-RPC and more. | ||
This flexibility allows users to assess diverse systems and applications effectively. | ||
2. Automation of Information Gathering Security Tests | ||
With Nettacker, users can automate reconnaissance, port scanning, vulnerability detection, and brute forcing workflows, minimizing the time and effort required for manual security testing. | ||
3. Modular and Scalable | ||
Its modular design enables users to customize and extend functionality by adding new modules for specific tasks. Nettacker can scale from small, targeted security assessments to large, enterprise-wide scans. | ||
4. Built-In Port Scanner and Subdomain Enumeration module | ||
Nettacker includes powerful Built-In Port Scanner and Subdomain Enumeration modules that streamline the initial stages of penetration testing. The Port Scanner module automatically identifies open ports on target systems, providing valuable insights into the services and potential attack surfaces exposed by a system. This is crucial for mapping a network and targeting specific services during vulnerability assessments. The Subdomain Enumeration module helps uncover hidden subdomains within a domain, which can be critical for identifying additional attack vectors or overlooked assets. Together, these built-in modules simplify the reconnaissance phase, helping security professionals gather key information efficiently before moving on to more advanced testing. | ||
5. Multi-Format Reporting | ||
The tool generates scan reports in multiple formats, including HTML, JSON, CSV and text. Nettacker’s ability to generate reports in JSON and CSV formats offers significant advantages. JSON provides a structured, machine-readable format that is easily parsed and integrated with other tools or systems, making it ideal for automated processing, data analysis, and integration with custom workflows. CSV, on the other hand, offers a simple, tabular format that is easy to read and process using spreadsheets or other data analysis tools. These formats make it easy to analyze findings and share results with stakeholders. | ||
6. Built-in Database | ||
Nettacker includes a built-in database for storing scan results. This ensures data persistence, allowing users to track past assessments, easily search and retrieve previous data from scan results, and generate reports for audit and compliance purposes | ||
6. The Web UI and API provide enhanced user interaction and integration capabilities. The Web UI offers a user-friendly interface for configuring scans, visualizing results, andsearching the scan data, making Nettacker accessible to both technical and less-technical users. The API allows for programmatic access, enabling automation and integration with third-party tools, CI/CD pipelines, and custom applications. | ||
|
||
 | ||
|
||
## Links | ||
|
||
* OWASP Page: https://www.owasp.org/nettacker | ||
* Wiki: https://github.com/OWASP/Nettacker/wiki | ||
* GitHub: https://github.com/OWASP/Nettacker | ||
* Official Docker Image: https://hub.docker.com/r/owasp/nettacker/ | ||
* Slack: #project-nettacker on https://owasp.slack.com (OWASP Slack inivite at https://owasp.org/slack/invite) | ||
* OWASP Nettacker Project Page: [https://www.owasp.org/nettacker](https://www.owasp.org/nettacker) | ||
* GitHub Repo: [https://github.com/OWASP/Nettacker](https://github.com/OWASP/Nettacker) | ||
* Official Docker Image: [https://hub.docker.com/r/owasp/nettacker/](https://hub.docker.com/r/owasp/nettacker/) | ||
* Slack: **#project-nettacker** on https://owasp.slack.com (get OWASP Slack invite at https://owasp.org/slack/invite) | ||
|
||
* OpenHub: https://www.openhub.net/p/OWASP-Nettacker | ||
* CI: https://github.com/OWASP/Nettacker/actions | ||
* **Donate**: [https://www.owasp.org/](https://owasp.org/donate/?reponame=www-project-nettacker&title=OWASP+Nettacker) | ||
* Original Creator/Maintainer: https://www.secologist.com/ | ||
* OpenHub: [https://www.openhub.net/p/OWASP-Nettacker](https://www.openhub.net/p/OWASP-Nettacker) | ||
* CI: [https://github.com/OWASP/Nettacker/actions](https://github.com/OWASP/Nettacker/actions) | ||
* **Donate to support this project**: [https://www.owasp.org/](https://owasp.org/donate/?reponame=www-project-nettacker&title=OWASP+Nettacker) | ||
* Original Creator/Maintainer: [https://www.secologist.com/](https://www.secologist.com/) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,68 +1,145 @@ | ||
**Contents**: | ||
# Installation | ||
|
||
* [Before Installation](#before-installation) | ||
* [Installation methods](#installation) | ||
* [After Installation](#after-installation) | ||
You have multiple options for installing OWASP Nettacker, each with specific instructions provided in dedicated sections below. | ||
|
||
|
||
### Supported Platforms | ||
|
||
OWASP Nettacker runs on Linux operating system (we recommend using the docker image to be able to run it on any OS). If you would like to run this on your machine you must install all dependencies and at least Python 3.10 | ||
OWASP Nettacker is designed to run on Linux and macOS systems. However, you can leverage the Docker image to run it on other operating systems as well. Although native Windows support was initially dropped, we are currently working towards reintroducing it in future versions, along with FreeBSD support. | ||
|
||
PLEASE NOTE: Starting from Nettacker version 0.3.1 the support for Python2 and Python <3.10 has been dropped. If you have a requirement to use Nettacker on Python 2.x or 3.0-3.9 you can use the legacy version of Nettacker [v0.0.2](https://github.com/OWASP/Nettacker/releases/tag/0.0.2) | ||
|
||
### Dependencies | ||
|
||
OWASP Nettacker has dependencies on the following libraries and tools: | ||
PLEASE NOTE: Python version 3.10-3.12 is required to run Nettacker. You can check the version of Python3 installed by running: | ||
|
||
``` | ||
python3 -V | ||
``` | ||
|
||
|
||
|
||
### Pre-requisites | ||
|
||
OWASP Nettacker depends on several libraries and tools which you might need to install if they are not already installed on your system: | ||
|
||
* python3-dev | ||
* python3-pip | ||
* libcurl4-openssl-dev | ||
* libcurl4-gnutls-dev | ||
* librtmp-dev | ||
* libssl-dev | ||
* python3-dev | ||
* libpq-dev (required if you wish to use PostgreSQL database) | ||
* libffi-dev | ||
* musl-dev | ||
* make | ||
* gcc | ||
* git | ||
|
||
Before using this software, please install the requirements following the commands below: | ||
Before using this software, please install the prerequisites by following the commands below): | ||
|
||
|
||
Install Python 3 first: | ||
Install Python3, PIP and VENV first (e.g. on Debian Linux/Ubuntu): | ||
``` | ||
apt-get update | ||
apt-get install -y python3 python3-dev python3-pip | ||
sudo apt-get update | ||
sudo apt-get install -y python3 python3-dev python3-pip python3-venv | ||
pip3 install --upgrade pip3 | ||
``` | ||
|
||
Starting from version 0.4.0 Nettacker is now using Poetry Package Manager and can be installed directly from PyPI. | ||
|
||
### Install Nettacker From PyPI Using PIPX | ||
|
||
Installing OWASP Nettacker using `pipx` is a convenient method for managing Python applications with isolated environments. `pipx` ensures that each installed tool has its own environment, avoiding dependency conflicts. | ||
|
||
Here’s how you can install OWASP Nettacker using `pipx`: | ||
|
||
1. Install pipx using apt or pip | ||
Using apt: | ||
``` | ||
sudo apt update | ||
sudo apt install pipx | ||
pipx ensurepath | ||
pipx --version | ||
``` | ||
or install pipx using using pip: | ||
|
||
``` | ||
python3 -m pip install --user pipx | ||
python3 -m pipx ensurepath | ||
``` | ||
|
||
2. Install nettacker using pipx | ||
``` | ||
pipx install nettacker | ||
nettacker --help | ||
``` | ||
### Install Nettacker from PyPI using PIP | ||
|
||
|
||
Starting from version 0.4.0 Nettacker and can be installed directly from PyPI. | ||
|
||
``` | ||
sudo apt update | ||
sudo apt install python3-venv python3-pip | ||
python3 -m venv venv | ||
. venv/bin/activate | ||
pip3 install nettacker | ||
nettacker --help | ||
``` | ||
|
||
PLEASE NOTE: Python version 3.10 or higher is required to run Nettacker. You can check the version of Python3 installed by running: | ||
### Install Nettacker using Git Clone and PIP | ||
|
||
``` | ||
python3 -V | ||
sudo apt update | ||
sudo apt install python3-venv python3-pip git | ||
python3 -m venv venv | ||
. venv/bin/activate | ||
git clone https://github.com/OWASP/Nettacker --depth 1 | ||
cd Nettacker | ||
pip3 install . | ||
python3 nettacker.py --help | ||
``` | ||
|
||
You can also run Nettacker after installation like this: | ||
|
||
``` | ||
nettacker --help | ||
``` | ||
|
||
### Install Nettacker using Git Clone and Poetry | ||
|
||
``` sudo apt update | ||
sudo apt install python3-poetry git | ||
git clone https://github.com/OWASP/Nettacker --depth 1 | ||
cd Nettacker | ||
poetry install | ||
poetry run nettacker --help | ||
``` | ||
|
||
If you have Python 3.10 or higher you should be able to run OWASP Nettacker via command: | ||
### What Happened to requirements.txt in Nettacker? | ||
|
||
In recent updates to OWASP Nettacker, the project has transitioned away from using the traditional `requirements.txt` file for dependency management. Starting from version 0.4.0, Nettacker adopted Poetry as its package manager instead of the `requirements.txt` file. Poetry simplifies dependency management, handling both the installation of dependencies and packaging more efficiently. | ||
|
||
`python3 nettacker.py` | ||
Now, the dependencies for Nettacker are listed in `pyproject.toml`, which is a modern PEP 518 standard. `pyproject.toml` is also used by Poetry package manager, and the installation process follows a different approach: | ||
You can install Nettacker directly from PyPI with the command `pip3 install nettacker` or if you have already cloned Nettacker git repo you can run `pip install .` inside the Nettacker folder. | ||
|
||
or simply | ||
|
||
`nettacker` | ||
To see the list of command options you can use: | ||
|
||
``` | ||
nettacker --help | ||
``` | ||
|
||
### Make your life easier using docker | ||
To run the API server, just run `docker-compose up`. if you need to run via command line use the commands below. | ||
or | ||
|
||
``` | ||
docker-compose up -d && docker exec -it nettacker_nettacker_1 /bin/bash | ||
nettacker -h | ||
``` | ||
|
||
|
||
### Install Nettacker Using Docker | ||
``` | ||
docker pull owasp/nettacker | ||
docker run -it owasp/nettacker /bin/bash | ||
``` | ||
|
||
For usage instructions and examples please read [Usage.md](Usage.md) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters