OWASP Nettacker v0.4.1 Released

By SecBurg

OWASP Nettacker is an open-source, Python-based automated penetration testing and information-gathering framework that scans networks, web applications, IoT devices, and APIs for security weaknesses.

A new version, v0.4.1, has just been released.

Highlights include SARIF and DefectDojo-compatible JSON output, custom wordlists and directory-enumeration base paths, port exclusions, HTTP scheme selection, custom request headers, and searchable profiles/results in the Web UI. New scanners were added for CUPS, SMB brute-force, and Jenkins, plus detections for a long list of recent CVEs affecting Palo Alto PAN-OS, SonicWall SSLVPN, WordPress, Joomla, aiohttp, Vite, CrushFTP, Metabase and more. Under the hood, runtime data moved from .data to .nettacker/data (with automatic SQLite migration), FreeBSD support and ARM container images were added, and the NumPy dependency was dropped.

Highlights:
- Added SARIF and DefectDojo-compatible JSON output
- Added custom wordlists and directory-enumeration base paths
- Added port exclusions, HTTP scheme selection, custom request headers, and sensitive-header filtering
- Exposed service-discovery, port-exclusion, and custom-header options in the Web UI
- Added browser uploads for targets and wordlists
- Added searchable profiles, scan methods, and results to the Web UI
- Added crt.name support to subdomain discovery
- Moved runtime data from .data to .nettacker/data, including automatic SQLite database migration
- Added FreeBSD support and ARM container images
- Removed the NumPy dependency

New scanning coverage:
- Added CUPS, configuration-file, SMB brute-force, Jenkins, SmarterMail, CrushFTP patch-date, and Adobe AEM patch-date scanners
- Expanded WordPress plugin coverage and refreshed bundled discovery wordlists
- Added detection for CVEs affecting Palo Alto PAN-OS, GlobalProtect, SonicWall SSLVPN, WordPress, Joomla, aiohttp, Vite, CrushFTP, Meteobridge, SmarterMail, React2Shell, Memos, GeoServer, Langflow, SiYuan, Sonatype Nexus Repository, Majordomo, Adobe ColdFusion, Nginx UI, and Metabase

Full release notes and changelog: github.com/OWASP/Nettacker/releases/tag/0.4.1

Happy testing! :-)