Evasion & Proxies
Relevant source files
The following files were used as context for generating this wiki page:
OWASP Nettacker incorporates various evasion techniques and proxy support to facilitate stealthy penetration testing and information gathering. These features are designed to reduce detection by security devices such as Firewalls, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS) while performing reconnaissance or vulnerability assessments.
The framework utilizes multi-protocol scanning (TCP, SYN, ACK, ICMP) and unique discovery methods to identify protected services, including SCADA devices, that might otherwise be hidden behind security layers. Evasion is primarily achieved through randomized request metadata, configurable delays, and routing traffic through proxy servers.
Sources: README.md:1-20, nettacker/web/static/index.html:129-136
Proxy Support
Nettacker provides built-in support for SOCKS proxies to mask the origin of the scanning traffic. This is particularly useful for bypassing IP-based filtering or geofencing during an engagement.
SOCKS Proxy Configuration
The engine supports SOCKS4 and SOCKS5 protocols, including authenticated sessions. Users can configure the proxy via the CLI or the Web UI.
The diagram above illustrates how the Nettacker Engine routes traffic through an intermediary proxy before reaching the target.
Sources: nettacker/locale/en.yaml:70-74, nettacker/web/static/index.html:246-252
Proxy Configuration Options
| Parameter | Description | Supported Formats |
|---|---|---|
socks_proxy | Outgoing connection proxy (SOCKS). | socks5://127.0.0.1:9050, socks4://user:pass@127.0.0.1:1080 |
retries | Number of retries when a connection through the proxy/network timeouts. | Integer (Default: 3) |
Sources: nettacker/locale/en.yaml:23, nettacker/locale/en.yaml:70-74, nettacker/web/static/index.html:246-252
HTTP Metadata Evasion
To avoid signature-based detection by web application firewalls, Nettacker allows for the randomization and customization of HTTP request headers.
User-Agent Randomization
The framework can rotate between different web browser User-Agents. This prevents security systems from identifying the scanner based on a static or default tool header. In the module definitions, this is often implemented using the {user_agent} placeholder which is dynamically populated by the engine.
Sources: nettacker/modules/vuln/nextjs_cve_2025_55182.yaml:38, nettacker/locale/en.yaml:85-87
Custom HTTP Headers
Users can inject custom headers into outgoing requests. This is useful for bypassing certain filters that require specific tokens or for emulating legitimate traffic patterns.
# Example of header customization in a vulnerability module
headers:
User-Agent: "{user_agent}"
next-action: "x"
Content-Type: "multipart/form-data; boundary=WebKitFormBoundaryx2pO7Ptc6DDP3Sad"
Sources: nettacker/modules/vuln/nextjs_cve_2025_55182.yaml:37-41, nettacker/web/static/index.html:266-274
Timing and Behavioral Evasion
Nettacker provides granular control over how requests are dispatched to avoid triggering rate-limiting or threshold-based alerts.
Delay and Timeout Controls
By adjusting the sleep time between requests and the connection timeouts, a tester can mimic manual browsing behavior or slow-down the scan to stay under the radar of automated blocking systems.
| Option | Description | Web UI Context |
|---|---|---|
time_sleep_between_requests | Time (in seconds) to wait between each outgoing request. | Advanced Options |
timeout | The maximum time to wait for a response from the target. | Engine Options |
thread_per_host | Limits concurrent connections to a single host to prevent DoS. | Advanced Options |
Sources: nettacker/web/static/index.html:214-230, nettacker/locale/en.yaml:124
Network-Level Evasion
The engine can perform a "ping before scan" check to ensure the host is alive before launching intensive modules, though this can be disabled or forced to scan anyway if the target is known to block ICMP.
Sources: nettacker/locale/en.yaml:14, nettacker/locale/en.yaml:104
Target & Fuzzing Evasion
Modules like http_cors_vuln demonstrate evasion by testing various origin patterns (e.g., pre-domain, post-domain, unescaped regex) to see how the target's security logic handles malformed or unexpected data.
Summary
Evasion and Proxies in OWASP Nettacker provide the necessary controls to conduct security assessments without immediately alerting defensive systems. Through a combination of SOCKS proxy routing, User-Agent randomization, custom HTTP headers, and adjustable request timing, the framework balances scanning speed with the need for stealth. These features are accessible via both CLI flags and the Web interface, ensuring they can be integrated into various penetration testing workflows.