Recon, CVE Checks, Default-Credential Brute Forcing With 135 OWASP Nettacker Modules: Sam Stepanyan and Arkadii Yakovets at Global AppSec USA 2026
OWASP Nettacker, an open-source automated penetration testing framework written in Python, now ships 135 modules, 68 of which check for specific CVEs such as Log4Shell and Citrix Bleed.
The name comes from "Network Attacker." Nettacker scans applications or networks, then reports on running services, bugs, vulnerabilities, misconfigurations and default credentials.
It can chain different scan methods together. It has drawn interest from penetration testers in Europe and Asia. It is also included in a specialist Linux distribution for security researchers.
In their Global AppSec USA 2026 project showcase, "Automated Security Testing with OWASP Nettacker", on Thursday, November 5 at 2:15 p.m. in Seacliff CD, Sam Stepanyan and Arkadii Yakovets run a live demo with practical examples of automated security testing.
Speakers:
- Sam Stepanyan, OWASP London Chapter Leader
- Arkadii Yakovets, Cybersecurity Lead, OWASP Nest and OWASP Nettacker
Nettacker's modules break down into 36 scan modules, 90 vulnerability checks and 9 brute-force modules. The brute-force modules test default or weak credentials over FTP, POP3, SMB, SMTP, SSH and Telnet, among others.
The CVE checks cover recent targets such as Ivanti Connect Secure, Palo Alto PAN-OS, CrushFTP, Langflow and Next.js. Targets can be IP addresses, ranges, CIDR blocks, domains or URLs.
Results come out as HTML, JSON, CSV or text reports. A built-in scan database detects drift between runs, so teams can use Nettacker in CI/CD to catch new exposures.
Nettacker runs from the command line, a REST API or a web interface. It is released under the Apache 2.0 license, with version 0.4.1 published in August 2026.
Sam Stepanyan is an independent application security consultant with more than 20 years in IT. He serves on the OWASP Global Board of Directors and has led the OWASP London Chapter since 2015.
He is a project leader of Nettacker who has also contributed to the OWASP Top 10 and OWASP ZAP. He received the 2023 OWASP WASPY award for chapter leadership.
He has presented Nettacker at Black Hat Europe Arsenal, Black Hat Asia, AppSec California and OWASP Global AppSec DC 2023. He has also consulted for City of London financial institutions on secure development and vulnerability management.
Arkadii Yakovets joined OWASP in 2023, started contributing to Nettacker that year and became a co-leader. He also founded OWASP Nest, which he leads, as a platform for exploring OWASP projects, chapters and ways to contribute.
He has mentored more than 10 Google Summer of Code students on OWASP and Python Software Foundation projects. He leads the open-source Python "holidays" library, which his board candidate page reports at more than 17 million monthly downloads.
He holds CISSP, CCSP and CSSLP certifications. He co-presented Nettacker with Stepanyan at Global AppSec EU 2026 in Vienna.
The Nettacker repository holds the full module list. The project documentation links recordings of past Nettacker talks going back to 2017.
To go deeper on the topic, start here:
- NDC Security 2026: Automated Security Testing with OWASP Nettacker (Sam Stepanyan, video)
- The Application Security Podcast: Sam Stepanyan on the OWASP Nettacker Project
- OWASP Nettacker on GitHub
- Help Net Security: OWASP Nettacker open-source scanner
- nettacker on PyPI
Security teams looking for a free scanner they can run on a schedule against their own external footprint will see Nettacker set up end to end.
How often does your team scan its own external footprint for default credentials and known CVEs?
2 points · 1 comment
Mentions
Recon, CVE Checks, Default-Credential Brute Forcing With 135 OWASP Nettacker Modules: Sam Stepanyan and Arkadii Yakovets at Global AppSec USA 2026 OWASP Nettacker, an open-source automated penetration testing framework written in Python, now ships 135 modules, 68 of which check for specific CVEs such as Log4Shell and Citrix Bleed. The name comes from "Network Attacker." Nettacker scans applications or networks, then reports on running services, bugs, vulnerabilities, misconfigurations and default credentials. It can chain different scan methods together. It has drawn interest from penetration testers in Europe and Asia. It is also included in a specialist Linux distribution for security researchers. In their Global AppSec USA 2026 project showcase, "Automated Security Testing with OWASP Nettacker", on Thursday, November 5 at 2:15 p.m. in Seacliff CD, Sam Stepanyan and Arkadii Yakovets run a live demo with practical examples of automated security testing. Speakers: - Sam Stepanyan, OWASP London Chapter Leader - Arkadii Yakovets, Cybersecurity Lead, OWASP Nest and OWASP Nettacker Nettacker's modules break down into 36 scan modules, 90 vulnerability checks and 9 brute-force modules. The brute-force modules test default or weak credentials over FTP, POP3, SMB, SMTP, SSH and Telnet, among others. The CVE checks cover recent targets such as Ivanti Connect Secure, Palo Alto PAN-OS, CrushFTP, Langflow and Next.js. Targets can be IP addresses, ranges, CIDR blocks, domains or URLs. Results come out as HTML, JSON, CSV or text reports. A built-in scan database detects drift between runs, so teams can use Nettacker in CI/CD to catch new exposures. Nettacker runs from the command line, a REST API or a web interface. It is released under the Apache 2.0 license, with version 0.4.1 published in August 2026. Sam Stepanyan is an independent application security consultant with more than 20 years in IT. He serves on the OWASP Global Board of Directors and has led the OWASP London Chapter since 2015. He is a project leader of Nettacker who has also contributed to the OWASP Top 10 and OWASP ZAP. He received the 2023 OWASP WASPY award for chapter leadership. He has presented Nettacker at Black Hat Europe Arsenal, Black Hat Asia, AppSec California and OWASP Global AppSec DC 2023. He has also consulted for City of London financial institutions on secure development and vulnerability management. Arkadii Yakovets joined OWASP in 2023, started contributing to Nettacker that year and became a co-leader. He also founded OWASP Nest, which he leads, as a platform for exploring OWASP projects, chapters and ways to contribute. He has mentored more than 10 Google Summer of Code students on OWASP and Python Software Foundation projects. He leads the open-source Python "holidays" library, which his board candidate page reports at more than 17 million monthly downloads. He holds CISSP, CCSP and CSSLP certifications. He co-presented Nettacker with Stepanyan at Global AppSec EU 2026 in Vienna. The Nettacker repository holds the full module list. The project documentation links recordings of past Nettacker talks going back to 2017. To go deeper on the topic, start here: - NDC Security 2026: Automated Security Testing with OWASP Nettacker (Sam Stepanyan, video) - The Application Security Podcast: Sam Stepanyan on the OWASP Nettacker Project - OWASP Nettacker on GitHub - Help Net Security: OWASP Nettacker open-source scanner - nettacker on PyPI Security teams looking for a free scanner they can run on a schedule against their own external footprint will see Nettacker set up end to end. How often does your team scan its own external footprint for default credentials and known CVEs?