Configuration & Defaults

Relevant source files

The following files were used as context for generating this wiki page:

• nettacker/config.py
• nettacker/core/lib/base.py
• AGENTS.md
• pyproject.toml
• nettacker/locale/en.yaml
• nettacker/web/static/index.html

OWASP Nettacker utilizes a centralized configuration system to manage framework behavior, API settings, database connectivity, and filesystem paths. This system ensures consistency across the CLI, REST API, and Web UI interfaces by providing a unified set of default values that can be overridden by user requirements.

The configuration architecture is primarily defined through Python classes that inherit from a base configuration object, allowing for easy dictionary conversion and iteration of settings. These configurations govern how the engine interacts with targets, manages concurrency, and handles sensitive data such as authentication tokens and headers.

Sources: nettacker/config.py:1-40, AGENTS.md:58-61

Core Configuration Architecture

The configuration is structured into specialized classes within the nettacker/config.py file. The Config class acts as a container for these specialized sections: api, db, path, and settings.

Configuration Class Hierarchy

The following diagram illustrates the relationship between the base configuration class and its specialized implementations.

API Configuration

The ApiConfig class defines the default behavior for the Nettacker REST API server. It includes security measures such as IP whitelisting and automatic token generation.

Parameter	Default Value	Description
api_hostname	"0.0.0.0"	The host address the API server binds to.
api_port	5000	The port for API communications.
api_access_key	Generated Random Token	32-character token used for authentication.
api_client_whitelisted_ips	[]	List of allowed IPs/CIDR ranges for API access.
api_debug_mode	False	Enables or disables Flask debug mode.
start_api_server	False	Boolean flag to toggle API startup.

Sources: nettacker/config.py:80-94, nettacker/locale/en.yaml:2-12

Database Configuration

Nettacker supports multiple database engines, primarily SQLite, MySQL, and PostgreSQL. The DbConfig class manages connection parameters and performance tuning for the storage layer.

Supported Engines and Modes

• SQLite: The default engine. It uses .nettacker/data/nettacker.db and supports optimization through journal_mode="WAL" and synchronous_mode="NORMAL".
• MySQL/Postgres: Require external host, port, username, and password configuration. Postgres supports ssl_mode settings (e.g., "require").

Sources: nettacker/config.py:97-124, nettacker/locale/en.yaml:57-58

Filesystem and Pathing

The PathConfig class defines the internal directory structure. This ensures that the engine, modules, and results are consistently located regardless of where the application is launched.

Default Scan Settings

The DefaultSettings class controls the execution logic of the scanning engine, including concurrency limits and network behavior.

Setting	Default	Description
thread_per_host	100	Number of concurrent threads per target host.
timeout	3.0	Default request timeout in seconds.
retries	1	Number of connection retries.
max_retries	3	Upper limit for retry attempts.
language	"en"	Default locale for reports and messages.
set_hardware_usage	"maximum"	Profiles for resource consumption (low, normal, high, maximum).
use_apsw_for_sqlite	True	Toggle between APSW and SQLAlchemy for SQLite operations.

Sources: nettacker/config.py:150-205, nettacker/locale/en.yaml:104-106, nettacker/web/static/index.html:150-200

Sensitive Data Handling

The framework maintains a list of sensitive_headers that are filtered out before logging or storing results to prevent the accidental exposure of credentials.

sensitive_headers = {
    "authorization",
    "proxy-authorization",
    "cookie",
    "set-cookie",
    "x-api-key",
    "x-amz-security-token",
    "x-auth-token",
}

The BaseEngine class uses the remove_sensitive_header_keys utility to sanitize events before they are committed to the database.

Sources: nettacker/config.py:59-77, nettacker/core/lib/base.py:112-115

Dependency and Environment Defaults

The pyproject.toml file defines the environment constraints and required dependencies for the framework to operate under default conditions.

• Python Version: Required version range is ^3.10, <3.13.
• Core Libraries: aiohttp for async requests, flask for the API, and sqlalchemy for database abstraction.
• Entry Points: The CLI command nettacker maps to nettacker.main:run.

Sources: pyproject.toml:1-60

Conclusion

Nettacker's configuration system provides a robust foundation for automated penetration testing by balancing sensible defaults with high extensibility. By segregating paths, API settings, and scan logic into discrete objects, the framework allows developers and users to easily adapt the tool to various environments—from local CLI usage to distributed API-driven deployments.