OWASP Nettacker: Automated Pentesting Framework Tutorial

Deepak Prasad
Tested on Kali GNU/Linux Rolling 2026.2 (kali-rolling)
Package docker.io 28.5.2+dfsg4-3
owasp/nettacker:latest (0.4.0 QUIN)
Applies to Kali Linux
Lab environment Kali + Metasploitable 2 on VirtualBox host-only — pentest lab setup
Privilege Normal user for Docker scans; sudo when Docker requires root on your Kali image
Scope Docker install, CLI help and version checks, port_scan against Metasploitable 2, module listing, and optional --start-api web UI. Does not cover Metasploit chaining, exploit development, or scanning hosts without authorization.
Related guides Ethical hacking tutorial

OWASP Nettacker chains many offensive modules behind one engine so you can run port scans, service probes, CVE checks, and login guessing without switching tools for every task. This walkthrough uses Docker on Kali against Metasploitable 2 because the current Nettacker release does not install cleanly on Python 3.13.

IMPORTANT
Run Nettacker only on systems you own or have explicit permission to assess. Use an isolated host-only or internal lab network. Do not aim automated modules at internet-facing hosts without authorization.

What is Nettacker in ethical hacking?

Nettacker is OWASP’s modular offensive framework. You pick targets with -i or -l, choose modules with -m, and the engine runs them with shared threading, reporting, and output options.

Typical module families include:

  • Reconnaissance and port scanning (port_scan, subdomain helpers)
  • HTTP and application checks (admin paths, CVE-specific modules)
  • Credential brute-force helpers for services such as SSH, FTP, and SMTP
  • Vulnerability modules mapped to CVE entries and vendor advisories

Version 0.4.0 (code name QUIN) loaded 107 modules in this lab. That is broader than a single-purpose scanner like Nmap alone, but Nettacker is not a replacement for manual validation — treat hits as leads for deeper vulnerability scanning and controlled exploitation in an authorized scope.

Compare Nettacker install methods

You can run Nettacker from the official container or from a local Python tree. On Kali Rolling with Python 3.13, Docker is the path that matches upstream without extra interpreters.

Method Best for Caveat
Docker (owasp/nettacker:latest) Kali 2026.x with Python 3.13 Use --network host for host-only lab targets; invoke poetry run python nettacker.py inside the image
pip install nettacker / Poetry from GitHub Custom forks or local module edits Requires Python 3.9–3.12; default Kali python3 is 3.13 in this release
Legacy virtualenv + requirements.txt Older guides Current upstream uses Poetry; Docker and Poetry paths are what this article tests

The sections below install with Docker first, then show why native pip fails on Kali 2026.2 so you recognize the error instead of fighting PEP 668 and version pins.

Kali lab setup

Set the lab once so every Docker command hits the same Metasploitable instance on your host-only segment. You need Docker on Kali, a reachable target IP, and normal user access to docker (or sudo docker when your image requires it).

Confirm Docker is available:

bash
docker --version

Sample output:

output
Docker version 28.5.2+dfsg4, build 9cc6dea35e9a963f281434761c656fba4ac43aed

That confirms the container runtime this article used. If docker is missing, install it with sudo apt install -y docker.io and start the daemon per your Kali image.

Set the authorized lab target once. On the standard pentest lab setup layout, Metasploitable listens on host-only 192.168.56.114:

bash
TARGET=192.168.56.114

Every scan below passes "$TARGET" into the container with -e TARGET="$TARGET". Replace the value only when your lab uses a different authorized address.

Install Nettacker with Docker

Pull the official OWASP image before the first scan. The tag latest tracked 0.4.0 QUIN during this refresh.

bash
docker pull owasp/nettacker:latest

Sample output:

output
latest: Pulling from owasp/nettacker
Digest: sha256:605a31ae92abfa896cdd3961b266676dafa6c31d917ea77348c0245db9d2dadd
Status: Image is up to date for owasp/nettacker:latest
docker.io/owasp/nettacker:latest

The digest line confirms which image layer set Docker resolved. You are ready to run Nettacker with docker run and --network host for lab targets on your Kali subnet.

Verify Nettacker CLI

The container does not expose a nettacker executable on PATH. Run the entry script through Poetry so dependencies such as multiprocess load correctly.

Check the loaded version and module count:

bash
docker run --rm --network host owasp/nettacker:latest sh -c 'cd /usr/src/owaspnettacker && poetry run python nettacker.py --version'

Sample output:

output
[2026-08-02 15:11:26][+] Nettacker engine started ...
[2026-08-02 15:11:29][+] 107 modules loaded ...
[2026-08-02 15:11:32][+] you are running OWASP Nettacker version 0.4.0 with code name QUIN

The 107 modules loaded line is your sanity check before you aim -m at a live target. If that count is zero, fix the install path before scanning.

Print the CLI usage banner and flag list:

bash
docker run --rm --network host owasp/nettacker:latest sh -c 'cd /usr/src/owaspnettacker && poetry run python nettacker.py -h'

Sample output:

output
usage: Nettacker [-L LANGUAGE] [-v] [--verbose-event] [-V]
                 [-o REPORT_PATH_FILENAME] [--graph GRAPH_NAME] [-h]
                 [-i TARGETS] [-l TARGETS_LIST] [-m SELECTED_MODULES]
                 [--modules-extra-args MODULES_EXTRA_ARGS]
                 [--show-all-modules] [--profile PROFILES]
                 [--show-all-profiles] [-x EXCLUDED_MODULES] [-u USERNAMES]
                 [-U USERNAMES_LIST] [-p PASSWORDS] [-P PASSWORDS_LIST]
                 [-g PORTS] [--user-agent USER_AGENT] [-T TIMEOUT]
                 [-w TIME_SLEEP_BETWEEN_REQUESTS] [-r] [-s] [-d]
                 [-t THREAD_PER_HOST] [-M PARALLEL_MODULE_SCAN]
                 ...
                 [--start-api]
                 [--api-host API_HOSTNAME] [--api-port API_PORT]
                 ...

The usage block shows -i for targets, -m for modules, -x to exclude modules, and --start-api for the web UI later in this guide.

Nettacker CLI flags

These flags cover the scans in this lab. Run -h inside the container when you need the full engine and API option list.

Flag Role
-i Single target IP, hostname, or URL
-l File with one target per line
-m Module names to run (comma-separated)
-x Modules to exclude from a profile or broad run
--profile Run a predefined profile (see --show-all-profiles)
-v / -V Verbose logging; -V also prints events
-t Threads per host
-g Port list or range for port modules
-u / -U Username or username file for login modules
-p / -P Password or password file for login modules
-o Report file path inside the container filesystem
--show-all-modules Print every module with severity and profiles
--start-api Start the HTTPS API and web UI

Profiles group modules (for example vuln, scan, http). For a first lab pass, a single module such as port_scan keeps runtime and log volume manageable.

Run port_scan against Metasploitable

port_scan maps open TCP ports on "$TARGET". With --network host, packets leave the container through Kali’s host-only interface the same way an Nmap scan from Kali would.

bash
docker run --rm --network host -e TARGET="$TARGET" owasp/nettacker:latest sh -c 'cd /usr/src/owaspnettacker && poetry run python nettacker.py -i "$TARGET" -m port_scan -v'

Sample output:

output
| 2026-08-02 15:11:45.256803 | 192.168.56.114 | port_scan   | 80   | Detected |
| 2026-08-02 15:11:45.190738 | 192.168.56.114 | port_scan   | 21   | Detected |
| 2026-08-02 15:11:45.323253 | 192.168.56.114 | port_scan   | 111  | Detected |
| 2026-08-02 15:11:46.384781 | 192.168.56.114 | port_scan   | 3306 | Detected |
| 2026-08-02 15:11:46.790112 | 192.168.56.114 | port_scan   | 5432 | Detected |
| 2026-08-02 15:11:51.428593 | 192.168.56.114 | port_scan   | 445  | Detected |
...
[2026-08-02 15:11:53][+] report saved in /usr/src/owaspnettacker/.data/results/results_2026_08_02_15_11_38_xnvgjethcu.html and database
[2026-08-02 15:11:53][+] ScanID: becpcbwxrxldnekuapujkkhgdhsijkum done!

Each Detected row is an open port Nettacker recorded for Metasploitable — FTP 21, HTTP 80, MySQL 3306, PostgreSQL 5432, and SMB 445 match what you expect on that image. The closing lines name the HTML report and ScanID to paste into lab notes.

To keep reports on the Kali filesystem, mount a host directory into the container results path before the same scan:

bash
mkdir -p "$HOME/nettacker-results"
docker run --rm --network host -v "$HOME/nettacker-results:/usr/src/owaspnettacker/.data/results" -e TARGET="$TARGET" owasp/nettacker:latest sh -c 'cd /usr/src/owaspnettacker && poetry run python nettacker.py -i "$TARGET" -m port_scan'

After the scan finishes, open the newest results_*.html file under $HOME/nettacker-results in a browser for a formatted table view.

List Nettacker modules and profiles

Before you widen -m beyond port_scan, list what 0.4.0 ships. The output is long; skim module names and severity scores to pick the next authorized test.

bash
docker run --rm --network host owasp/nettacker:latest sh -c 'cd /usr/src/owaspnettacker && poetry run python nettacker.py --show-all-modules'

Sample output:

output
[2026-08-02 15:12:01][+] 107 modules loaded ...
[2026-08-02 15:12:03][+] admin_scan: name: admin_scan, author: OWASP Nettacker Team, severity: 3, description: Admin Directory Finder, reference: None, profiles: ['scan', 'http', 'backup', 'low_severity']
[2026-08-02 15:12:03][+] apache_cve_2021_41773_vuln: name: apache_cve_2021_41773_vuln, author: OWASP Nettacker Team, severity: 9, description: A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49..., profiles: ['vuln', 'vulnerability', 'http', 'critical_severity', 'cve2021', 'cve', 'apache', 'path_traversal', 'lfi']
[2026-08-02 15:12:03][+] port_scan: name: port_scan, author: OWASP Nettacker Team, severity: 0, description: TCPConnect Scan module, reference: None, profiles: ['scan', 'information_gathering', 'subdomain_scan']

Module lines include profiles tags you can feed to --profile when you want a bundle instead of hand-picking -m. Exclude noisy or out-of-scope modules with -x on broader runs.

Start the Nettacker web UI with --start-api

--start-api launches Nettacker’s HTTPS API and browser UI on the port you choose. The process stays in the foreground; use Ctrl+C when you finish the lab.

Start the API on port 5001 with host networking so your browser on Kali reaches the listener:

bash
docker run --rm --network host owasp/nettacker:latest sh -c 'cd /usr/src/owaspnettacker && poetry run python nettacker.py --start-api --api-port 5001'

Sample output:

output
* API is accessible from https://nettacker-api.z3r0d4y.com:5001/ via API Key: lspmbellfiefjsdgxakzilcbbmothqbc
 * Serving Flask app 'nettacker.api.engine'
 * Running on https://127.0.0.1:5001
 * Running on https://10.0.2.15:5001
Press CTRL+C to quit

Copy the API key from the banner before you open the UI. In the browser, go to https://127.0.0.1:5001, accept the self-signed certificate warning, and paste that key on the login screen. From the New Scan tab you can set targets, pick profiles, and download HTML reports without retyping the Docker one-liner for every module mix.

Native Python install on Kali (optional)

Use a local tree when you are patching Nettacker or need a Python workflow outside Docker. Upstream 0.4.0 does not support the default Kali 3.13 interpreter.

Check the system Python version:

bash
python3 --version

Sample output:

output
Python 3.13.12

Attempting pip install nettacker in a fresh virtual environment on that interpreter fails:

bash
python3 -m venv /tmp/nettacker-venv && /tmp/nettacker-venv/bin/pip install nettacker

Sample output:

output
ERROR: Ignored the following versions that require a different python version: 0.4.0 Requires-Python >=3.9,<3.13
ERROR: Could not find a version that satisfies the requirement nettacker (from versions: none)
ERROR: No matching distribution found for nettacker

When you have Python 3.10–3.12 available, clone the repository and install with Poetry instead of the legacy virtualenv + requirements.txt path:

bash
git clone https://github.com/OWASP/Nettacker.git
cd Nettacker
poetry install
poetry run python nettacker.py --version

If Kali only ships 3.13, stay on the Docker workflow above rather than forcing a system Python downgrade.

Troubleshooting

Symptom Likely cause Fix
exec: "nettacker": executable file not found in $PATH Docker image has no nettacker binary on PATH Use sh -c 'cd /usr/src/owaspnettacker && poetry run python nettacker.py ...'
ModuleNotFoundError: No module named 'multiprocess' Ran python3 nettacker.py without Poetry Use poetry run python nettacker.py inside the image
No open ports / timeouts against 192.168.56.114 Container on bridge network cannot reach host-only lab Add --network host to docker run
No matching distribution found for nettacker on pip Python 3.13 outside supported range Use Docker or install Python 3.12 for a Poetry tree
Browser certificate warning on --start-api Default API uses a generated self-signed cert Accept for lab only or supply --api-cert and --api-cert-key
permission denied on docker run User not in docker group Run with sudo docker or add your user to the docker group on Kali

References

Summary

OWASP Nettacker bundles port scanning, HTTP checks, CVE-oriented modules, and login helpers behind one CLI and an optional HTTPS UI. On Kali Rolling 2026.2 the practical install path is the owasp/nettacker:latest image with poetry run python nettacker.py, because Nettacker 0.4.0 does not publish wheels for Python 3.13.

This lab pulled that image, confirmed version 0.4.0 QUIN with 107 modules, and ran port_scan against authorized Metasploitable 2 on "$TARGET" using --network host. The HTML report path and ScanID at the end of the run are what you should record before moving to heavier profiles or CVE modules.

The main Docker gotcha is invocation: there is no nettacker binary on PATH, and plain python3 nettacker.py skips Poetry’s dependency tree. When scans must reach a host-only lab segment, bridge networking is not enough — host networking matches how you would run Nmap from Kali directly.

For the GUI, --start-api prints an API key and listens on https://127.0.0.1:5001 with a self-signed certificate. Use that interface when you want profile-driven scans without rebuilding Docker one-liners. Continue the course with broader vulnerability scanning or service-specific brute-force chapters once you have written authorization scope and baseline port data from Nettacker or Nmap.

Frequently Asked Questions

1. What is OWASP Nettacker?

OWASP Nettacker is an open-source automated penetration testing framework from OWASP. It bundles reconnaissance, port scanning, service checks, CVE-oriented modules, and credential brute-force helpers behind one CLI and an optional HTTPS web UI started with --start-api.

2. Is Nettacker legal to use?

Nettacker is appropriate only on systems you own or are explicitly authorized to test. Automated scanning and brute-force modules can violate computer misuse laws, cloud contracts, and employer policy when aimed at third-party hosts without written permission.

3. Why does pip install nettacker fail on Kali Linux?

Nettacker 0.4.0 requires Python 3.9 through 3.12. Kali Rolling 2026.2 ships Python 3.13 as the default interpreter, so pip reports no matching distribution. Use the official owasp/nettacker Docker image, or install Python 3.12 in a virtual environment before running poetry install from the GitHub repository.

4. Why must Docker use --network host for lab scans?

Default bridge networking puts the container on an isolated subnet. Metasploitable on a VirtualBox host-only network such as 192.168.56.114 is reachable from Kali on that segment, not from the container bridge. --network host lets Nettacker use the same routes and interfaces as your Kali VM.

5. How do I run Nettacker inside the Docker image?

The image does not place a nettacker binary on PATH. Change to /usr/src/owaspnettacker and run poetry run python nettacker.py with your flags. Calling python3 nettacker.py without poetry skips dependencies and raises ModuleNotFoundError for multiprocess.
Kennedy Muthii

Information Security Analyst

Accomplished professional proficient in Python, ethical hacking, Linux, cybersecurity, and OSINT. With a track record including winning a national cybersecurity contest, launching a startup in Kenya, and holding a degree in information science, he is currently engaged in cutting-edge research in ethical hacking.

Expertise
  • Python (programming language)
  • Certified Ethical Hacker
  • White Hat (Computer Security)
  • Linux
  • Penetration Testing

Related Articles

security

SSH Brute Force Attack Tools and Examples on Kali Linux

Learn SSH brute force testing on Kali Linux with Hydra, Ncrack, Patator, Metasploit ssh_login, and Nmap …

11 min readsecurity

PostgreSQL Brute Force Attack Tools and Examples on Kali Linux

Learn PostgreSQL brute force testing on Kali Linux with Hydra, Ncrack, Patator, Metasploit postgres_login, and …

10 min readsecurity

DDoS Attack Example with Torshammer on Kali Linux

Run Torshammer slow POST DoS tests on Kali Linux against local Apache or DVWA, compare DoS versus DDoS, and …

7 min read