Project Overview
OWASP Nettacker is an open-source automated penetration testing framework written in Python. You point it at a host, a CIDR range, or a list of targets, and it runs modular scans for reconnaissance, port discovery, service fingerprinting, default-credential brute forcing, and known-vulnerability checks. It then writes results to a local database and exports human-readable reports.
The practical use case is breadth: when you need to sweep a large address space quickly and get a consolidated report instead of stitching together output from ten separate tools. Nettacker runs many modules concurrently and stores every scan, so you can re-run later and diff what changed on the network.
Nettacker is an official OWASP project, which means it sits inside a recognized security community rather than being a single-maintainer side project. Adoption signals are mixed as of 2026-06-12: star growth is up about 21.9% over the last ~6 months, but the internal hotness/adoption confidence score is 55.6 with an adoption trend down 17.9%. Read that as a healthy, real project with uneven momentum — fine for use, but check recent commit activity before you build a workflow that depends on a specific module.
Key Challenges Addressed
The core problem Nettacker targets is tool sprawl during the recon and discovery phase. Instead of running nmap, a brute-force tool, and a vuln checker separately and reconciling their output by hand, you get one engine that orchestrates all three and stores the results together.
It addresses a few concrete pain points:
- Scanning at scale without writing your own concurrency layer — Nettacker fans out modules across targets in parallel.
- Change detection over time — because scans persist to a database, you can compare a new scan against an old one to spot newly opened ports or newly exposed services.
- Repeatable scan definitions — modules are declarative YAML, so a scan profile is a file you can version-control and re-run, not a one-off command you have to remember.
Getting Started
The fastest path is Docker, which avoids Python dependency conflicts.
docker run -it owasp/nettacker python nettacker.py --help
A minimal scan against a single host looks like this:
python nettacker.py -i 192.168.1.1 -m port_scan -t 100
Here -i is the target, -m selects the module, and -t sets thread count. To launch the web interface and API instead of the CLI:
python nettacker.py --start-api
Sharp edges to plan for:
- If you run a native Python install instead of Docker, version drift breaks you. Nettacker pins specific dependency versions, and a mismatched system Python will fail on import. Use the Docker image or a dedicated virtualenv with
pip install -r requirements.txtfirst. - A high
-tthread count against a fragile target will produce dropped connections and false negatives, not faster results. Start at a low thread count and raise it only after a clean baseline run. - The brute-force and vulnerability modules generate real, noisy traffic. Run them only against systems you are authorized to test — Nettacker will not stop you from scanning something you should not.
Features and Use Cases
Nettacker's feature set is organized around modules. You can run a single module, a comma-separated list, or scan profiles that group modules together.
Realistic workflows it supports:
- Network discovery: enumerate live hosts and open ports across a subnet, then fingerprint services.
- Credential hygiene checks: test for default and weak credentials on exposed services like SSH, FTP, and SMTP.
- Periodic monitoring: schedule scans and diff results to catch infrastructure drift, such as a port that should be closed but reopened after a deploy.
- Reporting for stakeholders: export to HTML for a readable summary or JSON/CSV when you need to feed results into another system.
The web UI and REST API matter if you want to drive scans from another tool or give non-CLI users a way to launch and review scans.
Ecosystem and Dependencies
Nettacker is built on the Python ecosystem and leans on standard networking and parsing libraries rather than reinventing them. It is best understood as an orchestration layer that sits alongside, not in place of, specialized tools.
In practice you will still reach for dedicated scanners for deep work. nmap remains the reference for granular port and service scanning, nuclei for template-driven vulnerability detection, and sqlmap for focused SQL injection testing. Nettacker gives you a single front end and a unified result store; the specialist tools give you depth on a specific class of problem.
Architectural Overview
The design has three moving parts: a module engine, an execution layer, and a results store.
Modules are declarative definitions of what to scan and how to interpret responses. The engine loads them, the execution layer runs them concurrently across your target list using a thread pool, and results are written to a local database. The web API and CLI are both thin clients over this same engine, which is why a scan launched from the UI behaves identically to one launched from the command line.
Why this matters to you: the module-as-data approach means extending Nettacker is mostly writing YAML, not patching Python internals. The persistent database is what makes historical comparison possible — that is the operability win over fire-and-forget scanners. The tradeoff is that the engine is only as good as its modules, so coverage for any given vulnerability class depends on whether a current module exists.
Pros and Cons
Pros:
- One orchestration layer over recon, port scanning, brute force, and vuln checks, with consolidated reporting.
- Persistent scan history enables change detection and diffing.
- Module definitions are declarative YAML you can version and share.
- OWASP stewardship gives it community backing and a clear home.
Cons:
- Module depth does not match dedicated tools — for serious vuln detection you will still pair it with
nucleior similar. - Adoption momentum is uneven; the adoption trend over the last ~6 months is negative even though stars grew.
- Native installs are dependency-fragile; you are effectively pushed toward Docker.
Comparison and Alternatives
GitHub stars
Weekly star gains
Full metrics details
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
Nettacker
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
127 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
140 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Issues opened
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Nettacker
GitHub API observation. Historical values render only when the source provides a real observation for that day.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub API observation. Historical values render only when the source provides a real observation for that day.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub API observation. Historical values render only when the source provides a real observation for that day.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub API observation. Historical values render only when the source provides a real observation for that day.
101 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub API observation. Historical values render only when the source provides a real observation for that day.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Issues closed
Weekly total
Full metrics details
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
Nettacker
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
101 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests opened
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Nettacker
GitHub API observation. Historical values render only when the source provides a real observation for that day.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub API observation. Historical values render only when the source provides a real observation for that day.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub API observation. Historical values render only when the source provides a real observation for that day.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub API observation. Historical values render only when the source provides a real observation for that day.
101 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub API observation. Historical values render only when the source provides a real observation for that day.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests closed
Weekly total
Full metrics details
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
Nettacker
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
101 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests merged
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Nettacker
GitHub API observation. Historical values render only when the source provides a real observation for that day.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub API observation. Historical values render only when the source provides a real observation for that day.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub API observation. Historical values render only when the source provides a real observation for that day.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub API observation. Historical values render only when the source provides a real observation for that day.
101 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub API observation. Historical values render only when the source provides a real observation for that day.
142 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Open/closed pull request ratio
Weekly average
Full metrics details
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
Nettacker
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
127 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
140 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Open/closed issues ratio
Weekly average
Full metrics details
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
Nettacker
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
127 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
140 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Releases
Weekly total
Full metrics details
GitHub release published_at events bucketed by UTC day; drafts are excluded.
Nettacker
GitHub release published_at events bucketed by UTC day; drafts are excluded.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nmap
GitHub release published_at events bucketed by UTC day; drafts are excluded.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
nuclei
GitHub release published_at events bucketed by UTC day; drafts are excluded.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub release published_at events bucketed by UTC day; drafts are excluded.
127 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
sqlmap
GitHub release published_at events bucketed by UTC day; drafts are excluded.
140 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OpenVAS
GitHub release published_at events bucketed by UTC day; drafts are excluded.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Hotness score
Weekly average
Full metrics details
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
Nettacker
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
nmap
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
177 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
nuclei
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
OWASP ZAP
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
127 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
sqlmap
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
140 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
OpenVAS
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
Reliability score
Weekly average
Full metrics details
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
Nettacker
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
nmap
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
177 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
nuclei
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
OWASP ZAP
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
127 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
sqlmap
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
140 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
OpenVAS
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
Nettacker competes with a mix of full scanners and focused tools. Compare it against these credible alternatives:
| Project | Repo | Hotness (~6mo) | PRs merged (~6mo) | Star growth (~6mo) |
|---|---|---|---|---|
| OWASP Nettacker | https://github.com/OWASP/Nettacker | 63.37 | 106 | 899 |
| nmap | https://github.com/nmap/nmap | metrics pending | 0 | 150 |
| nuclei | https://github.com/projectdiscovery/nuclei | 65.02 | 61 | 4877 |
| OWASP ZAP | https://github.com/zaproxy/zaproxy | 51.05 | 100 | 1134 |
| sqlmap | https://github.com/sqlmapproject/sqlmap | 71.27 | 5 | 1542 |
| OpenVAS | https://github.com/greenbone/openvas-scanner | metrics pending | 0 | 44 |
For template-driven vulnerability detection with strong docs, an active maintainer team, and a large community template library, nuclei is the best overall alternative. It moves faster and covers more vulnerability classes out of the box than Nettacker's module set.
Conclusion
If you run periodic security sweeps across a large internal network and want one tool that orchestrates recon, port scanning, and credential checks into a single diffable report, use OWASP Nettacker — the persistent scan database makes change detection genuinely easy. Start with the official documentation and the Docker image.
Do not run a native pip install against your system Python and expect it to work; Nettacker pins dependency versions and a mismatched interpreter fails on import. Do this first: docker run -it owasp/nettacker python nettacker.py --help to confirm a clean environment before you scan anything.