admin_scan reports the homepage as an admin page

Open Beginner friendly
  • Is something wrong?
#1,850 1 comment 1 reaction 1 assignee View on GitHub

Maintainers usually reply within 1 day

@Alfa-Dev404 is already working on this.

Since Nov 7, 2026.

  • #1853 by @Alfa-Dev404 — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security, testing

Research direction

Start with read_from_file() in nettacker/core/fuzzer.py and the wordlist checks in test_wordlists.py; compare how trailing and leading blank lines are handled. Reproduce with the admin wordlist or a custom -W list, then confirm the empty trailing entry is gone while the intentional blank password remains. Done when the tests pass and admin_scan no longer requests the homepage as an admin path.

Written by the indexing model from the issue text.

Description

While testing admin_scan locally I noticed it reports the homepage as a finding, even on a site with no admin pages at all.

Looks like it's the trailing newline in admin_wordlist.txt (added in #1366). read_from_file() in fuzzer.py does .split("\n"), so the last entry ends up empty:

python -c 'from nettacker.core.fuzzer import read_from_file; w = read_from_file("wordlists/admin_wordlist.txt"); print(len(w), repr(w[-1]))'
507 ''

test_wordlists.py expects 506. That empty entry turns into a request for just http://target:port/, and admin.yaml matches 200/401/403, so basically any site with a working homepage gets flagged.

To reproduce:

mkdir -p /tmp/site && echo home > /tmp/site/index.html
python -m http.server 18080 --bind 127.0.0.1 --directory /tmp/site

# in another terminal
python nettacker.py -i 127.0.0.1 -g 18080 -d -m admin_scan

All the admin paths 404, but http://127.0.0.1:18080/ still shows up as found (507 requests instead of 506).

Same thing shows up in a few other places:

  • the password list also ends with a newline, so brute modules try the blank password twice per user (Modules.md actually mentions this)
  • a custom -W list with a trailing newline makes dir_scan report //
  • #1440 adds trailing newlines to 6 more wordlists, so dir/pma/config/wp scans would start doing it too

I tried dropping just the trailing newline in read_from_file() (.read().removesuffix("\n").split("\n")) so the blank first line in the password list still works. With that, admin_scan sends 506 requests, no false hit, and still finds a real /administrator/ page. Brute modules go back to 1,001 passwords per user like the docs say.

Linux Mint 22.3, Python 3.12.3, Nettacker 0.4.2 (master f333cee7)

Can I take this one?

Dominant language
Python
Stars
5.7k
Forks
1.2k
Avg merge
5d 1h
Merged PRs (30d)
10

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OWASP/Nettacker

All issues in OWASP/Nettacker

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.