Network Protocols Library
Relevant source files
The following files were used as context for generating this wiki page:
The Network Protocols Library in OWASP Nettacker serves as the foundational communication layer for the framework's modular scanning architecture. It provides standardized abstractions for interacting with various network protocols, enabling the framework to automate penetration testing tasks such as port scanning, service detection, and credential brute-forcing.
This library is designed to facilitate multi-protocol and multithreaded scanning across diverse target types, including IPv4 addresses, CIDR blocks, and domain names. It acts as the intermediary between high-level scanning modules and low-level network operations, ensuring consistent handling of timeouts, retries, and proxy configurations.
Sources: README.md:25-33, nettacker/config.py:101-103
Architecture and Core Components
The protocol library is structured around a base execution engine and specific protocol implementations. The architecture prioritizes modularity, allowing new protocols or scanning methods to be added without modifying the core engine logic.
Base Engine and Library Classes
The library utilizes abstract base classes to define the interface for protocol operations:
- BaseLibrary: An abstract class that defines the blueprint for protocol-specific libraries, including methods for operations like brute-forcing.
- BaseEngine: The execution core that manages data flow, process conditions, and dependent event handling.
Sources: nettacker/core/lib/base.py:20-33
Communication Flow
The following diagram illustrates how the BaseEngine interacts with protocol-specific libraries and the database to execute a scan step.
The engine manages a retry loop for protocol actions and handles "dependent events" where a scanning step requires data obtained from a previous successful event stored in the database.
Sources: nettacker/core/lib/base.py:180-245
Protocol Support and Capabilities
The library supports a wide array of protocols and communication techniques to detect and bypass security devices like Firewalls, IDS, and IPS.
Supported Protocols
| Protocol Category | Examples / Implementations |
|---|---|
| Transport | TCP, SYN, ACK, ICMP |
| Application | HTTP/HTTPS, FTP, SSH, SMB, SMTP, TELNET, XML-RPC |
| Security | SSL/TLS |
Sources: README.md:29, nettacker/web/static/index.html:128-131
Evasion and Proxy Support
To facilitate stealthy scanning, the library integrates proxy support and randomized identifiers:
- SOCKS Proxy: Support for SOCKS4, SOCKS4a, and SOCKS5 with authentication.
- User-Agents: Configurable or randomized User-Agent strings for HTTP-based protocols.
- Timeouts and Delays: Configurable request timeouts and sleep intervals between requests.
Sources: nettacker/config.py:176-180, nettacker/locale/en.yaml:73-77
Core Execution Logic
The BaseEngine contains critical logic for processing network responses and determining if a scan result meets specific criteria (conditions).
Condition Processing
When a protocol action returns data, the engine evaluates it against predefined conditions. If conditions are met, the event is logged as a success.
- Sensitive Data Scrubbing: Before logging to the database or terminal, sensitive HTTP headers (e.g.,
authorization,cookie,x-api-key) are removed. - Large Content Filtering: Response bodies are truncated if they exceed a specific threshold (default 150 characters) to keep reports readable.
Sources: nettacker/core/lib/base.py:40-45, nettacker/core/lib/base.py:96-105, nettacker/config.py:46-61
Data Handling Sequence
The following sequence diagram shows the data handling process during a successful scan event.
Sources: nettacker/core/lib/base.py:96-174
Configuration Parameters
The protocol library behavior is governed by DefaultSettings and protocol-specific configurations defined in the project's configuration system.
| Parameter | Type | Default | Description |
|---|---|---|---|
timeout | Float | 3.0 | Request timeout in seconds |
retries | Integer | 1 | Initial retry count for actions |
max_retries | Integer | 3 | Maximum allowed connection retries |
socks_proxy | String | None | Proxy URL (e.g., socks5://127.0.0.1:9050) |
time_sleep_between_requests | Float | 0.0 | Delay between consecutive requests |
user_agent | String | Generated | The User-Agent header for HTTP requests |
Sources: nettacker/config.py:145-185
Summary
The Network Protocols Library is the core engine of OWASP Nettacker's network interaction. By abstracting complex socket, HTTP, and SSL operations into a standardized BaseEngine and BaseLibrary framework, it allows for scalable, multi-threaded security assessments. Its built-in support for evasion techniques like SOCKS proxies and randomized User-Agents, combined with strict sensitive data handling, makes it a robust component for automated penetration testing.