Installation Guide
Relevant source files
The following files were used as context for generating this wiki page:
OWASP Nettacker is a modular automated penetration testing framework designed for information gathering and vulnerability scanning. To accommodate different environments and user preferences, it supports multiple installation methods, including native Python installation via Poetry, Docker containerization for both CLI and Web UI, and manual setup for development purposes.
The framework supports Python versions 3.10 through 3.12 and is designed to be operating system independent, though some features like ICMP scanning require root privileges. Sources: AGENTS.md:32, pyproject.toml:50, README.md:128
Prerequisites and System Requirements
Before installation, ensure your system meets the following requirements:
- Python: Versions 3.10, 3.11, or 3.12. Sources: AGENTS.md:32, pyproject.toml:50
- Privileges: Root/Administrator access is required for specific modules like
icmp_scanor the--ping-before-scanfeature. Sources: nettacker/locale/en.yaml:15 - Operating System: Linux, macOS, or Windows (OS Independent). Sources: pyproject.toml:14, AGENTS.md:32
Installation via Poetry (Recommended for Development)
OWASP Nettacker uses Poetry for dependency management and packaging. This method is ideal for users who wish to run the tool natively or contribute to the project.
Step-by-Step Native Installation
- Clone the Repository: Obtain the source code from GitHub.
- Install Dependencies: Use Poetry to handle the environment and libraries.
poetry install - Verify Installation: Check the help menu to ensure the CLI is functional.
poetry run nettacker --help
Sources: AGENTS.md:18-22, pyproject.toml:1-48
Key Dependencies
The following core libraries are installed during this process:
| Dependency | Purpose |
|---|---|
aiohttp | Asynchronous HTTP client/server |
sqlalchemy | Database toolkit and ORM |
flask | Web framework for the API/UI |
impacket | Network protocol manipulation |
paramiko | SSHv2 protocol implementation |
apsw | SQLite wrapper (optional alternative to SQLAlchemy) |
Sources: pyproject.toml:51-72
Installation via Docker
Docker provides a consistent environment and simplifies the management of complex dependencies.
CLI Docker Usage
Users can run a single scan without local installation by pulling the official image:
docker run owasp/nettacker -i <target> -m <module>
Sources: README.md:106-114
Web UI and API via Docker Compose
For the full Web Interface and API experience, Docker Compose orchestrates the necessary services:
- Start Services:
docker-compose up - Access UI: The interface is available at
https://localhost:5000. - Authentication: The API Key required for login is displayed in the Docker logs.
docker logs nettacker_nettacker
Sources: README.md:121-127, AGENTS.md:23
Framework Structure and Configuration
Upon installation, the framework initializes a specific directory structure for runtime data. By default, this is located in the .nettacker folder within the current working directory.
Directory Mapping
The framework organizes its components into core logic, modules, and runtime data.
The data directory .nettacker/data/ is used for the database and scan results; it should not be committed to version control. Sources: AGENTS.md:9-15, nettacker/config.py:102-116
Configuration Defaults
Nettacker uses a config.py file to define default behaviors for the engine, API, and database.
| Category | Default Value | Description |
|---|---|---|
| API Host | 0.0.0.0 | Binding address for the API server |
| API Port | 5000 | Listening port for the API server |
| DB Engine | sqlite | Default storage engine |
| DB Path | .nettacker/data/nettacker.db | Location of the SQLite database |
| Threading | 100 | Default threads per host |
Sources: nettacker/config.py:78-95, nettacker/config.py:133-145
Deployment Flow
The following diagram illustrates the lifecycle from installation to running the first scan.
A successful installation results in the automatic creation of the local database and results directories during the first execution. Sources: AGENTS.md:12-23, README.md:121-130
Conclusion
OWASP Nettacker offers flexible installation paths tailored for different use cases. Native installation via Poetry provides the most control for developers, while Docker-based methods offer rapid deployment for security practitioners. Regardless of the method chosen, the framework maintains a consistent data structure and configuration profile to ensure portability of scan results and settings. Sources: README.md:86-104, AGENTS.md:7-15