Skip to content

Latest commit

 

History

History
262 lines (235 loc) · 14.9 KB

README.md

File metadata and controls

262 lines (235 loc) · 14.9 KB
Raw

Python tools for penetration testers

If you are involved in vulnerability research, reverse engineering or pentesting, I suggest to try out the Python programming language. It has a rich set of useful libraries and programs. This page lists some of them.

Most of the listed tools are written in Python, others are just Python bindings for existing C libraries, i.e. they make those libraries easily usable from Python programs.

Some of the more aggressive tools (pentest frameworks, bluetooth smashers, web application vulnerability scanners, war-dialers, etc.) are left out, because the legal situation of these tools is still a bit unclear in Germany -- even after the decision of the highest court. This list is clearly meant to help whitehats, and for now I prefer to err on the safe side.

Network

  • Scapy: send, sniff and dissect and forge network packets. Usable interactively or as a library
  • Impacket: craft and decode network packets. Includes support for higher-level protocols such as NMB and SMB
  • SMBMap: enumerate Samba share drives across an entire domain
  • dpkt: fast, simple packet creation/parsing, with definitions for the basic TCP/IP protocols
  • AutoRecon: Multi-threaded network reconnaissance tool
  • Mitm6: IPv6-based MITM tool that exploits IPv6 features to conduct man-in-the-middle attacks
  • Habu: python network hacking toolkit
  • Knock Subdomain Scan, enumerate subdomains on a target domain through a wordlist
  • SubBrute, fast subdomain enumeration tool
  • pypcap, Pcapy, Pcapy-NG and libpcap: several different Python bindings for libpcap
  • libdnet: low-level networking routines, including interface lookup and Ethernet frame transmission
  • Mallory, extensible TCP/UDP man-in-the-middle proxy, supports modifying non-standard protocols on the fly
  • Pytbull-NG: flexible IDS/IPS testing framework (shipped with more than 300 tests)
  • Spoodle: A mass subdomain + poodle vulnerability scanner

Debugging and reverse engineering

  • Frida: A dynamic instrumentation framework which can inject scripts into running processes
  • Capstone: lightweight multi-platform, multi-architecture disassembly framework with Python bindings
  • Unicorn Engine: CPU emulator framework with Python bindings
  • Androguard: reverse engineering and analysis of Android applications
  • Paimei: reverse engineering framework, includes PyDBG, PIDA, pGRAPH
  • IDAPython: IDA Pro plugin that integrates the Python programming language, allowing scripts to run in IDA Pro
  • PyEMU: fully scriptable IA-32 emulator, useful for malware analysis
  • pefile: read and work with Portable Executable (aka PE) files
  • pydasm: Python interface to the libdasm x86 disassembling library
  • PyDbgEng: Python wrapper for the Microsoft Windows Debugging Engine
  • diStorm: disassembler library for AMD64, licensed under the BSD license
  • python-ptrace: debugger using ptrace (Linux, BSD and Darwin system call to trace processes) written in Python
  • Keystone: lightweight multi-platform, multi-architecture assembler framework with Python bindings
  • PyBFD: Python interface to the GNU Binary File Descriptor (BFD) library
  • CHIPSEC: framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components.
  • Ghidatron: The FLARE team's open-source extension to add Python 3 scripting to Ghidra.

Fuzzing

  • afl-python: enables American fuzzy lop fork server and instrumentation for pure-Python code
  • Sulley: fuzzer development and fuzz testing framework consisting of multiple extensible components
  • Peach Fuzzing Platform: extensible fuzzing framework for generation and mutation based fuzzing (v2 was written in Python)
  • untidy: general purpose XML fuzzer
  • Powerfuzzer: highly automated and fully customizable web fuzzer (HTTP protocol based application fuzzer)
  • Construct: library for parsing and building of data structures (binary or textual). Define your data structures in a declarative manner
  • Fusil: Python library used to write fuzzing programs

Web

  • XSStrike: Advanced XSS detection suite
  • Requests: elegant and simple HTTP library, built for human beings
  • lxml: easy-to-use library for processing XML and HTML; similar to Requests
  • HTTPie: human-friendly cURL-like command line HTTP client
  • Twill: browse the Web from a command-line interface. Supports automated Web testing
  • FunkLoad: functional and load web tester
  • spynner: Programmatic web browsing module for Python with Javascript/AJAX support
  • mitmproxy: SSL-capable, intercepting HTTP proxy. Console interface allows traffic flows to be inspected and edited on the fly
  • spidy: simple command-line web crawler with page downloading and word scraping
  • https://github.com/TrixSec/waymap: web vulnerability scanner built for penetration testers

Forensics

  • Volatility: extract digital artifacts from volatile memory (RAM) samples
  • Rekall: memory analysis framework developed by Google
  • TrIDLib, identify file types from their binary signatures. Now includes Python binding

Malware analysis

  • pyew: command line hexadecimal editor and disassembler, mainly to analyze malware
  • Exefilter: filter file formats in e-mails, web pages or files. Detects many common file formats and can remove active content
  • jsunpack-n, generic JavaScript unpacker: emulates browser functionality to detect exploits that target browser and browser plug-in vulnerabilities
  • yara-python: identify and classify malware samples
  • phoneyc: pure Python honeyclient implementation
  • CapTipper: analyse, explore and revive HTTP malicious traffic from PCAP file
  • Cuckoo: Automated malware analysis system
  • CAPE: Malware configuration and payload extraction

PDF

  • pdfminer.six: extract text from PDF files
  • peepdf-3: Python tool to analyse and explore PDF files to find out if they can be harmful
  • Didier Stevens' PDF tools: analyse, identify and create PDF files
  • pyPDF: pure Python PDF toolkit: extract info, spilt, merge, crop, encrypt, decrypt...

Misc

  • Angr: Powerful binary analysis framework for vulnerability research and exploit development
  • ScoutSuite: Multi-cloud security auditing tool
  • Exomind: framework for building decorated graphs and developing open-source intelligence modules and ideas, centered on social network services, search engines and instant messaging
  • simplejson: JSON encoder/decoder, e.g. to use Google's AJAX API
  • PyMangle: command line tool and a python library used to create word lists for use with other penetration testing tools
  • Hachoir: view and edit a binary stream field by field
  • py-mangle: command line tool and a python library used to create word lists for use with other penetration testing tools
  • wmiexec.py: execute Powershell commands quickly and easily via WMI
  • Pentestly: Python and Powershell internal penetration testing framework
  • hacklib: Toolkit for hacking enthusiasts: word mangling, password guessing, reverse shell and other simple tools
  • Certipy: Active Directory Certificate Services enumeration and abuse tool
  • BloodHound.py: Python-based BloodHound ingestor for Active Directory security assessment

Other useful libraries and tools

  • Project Jupyter: enhanced interactive shell with many features for object introspection, system shell access, and its own special command system
  • Beautiful Soup: HTML parser optimized for screen-scraping
  • matplotlib: make 2D plots of arrays
  • Mayavi: 3D scientific data visualization and plotting
  • RTGraph3D: create dynamic graphs in 3D
  • Twisted: event-driven networking engine
  • Suds: lightweight SOAP client for consuming Web Services
  • NetworkX: graph library (edges, nodes)
  • Pandas: library providing high-performance, easy-to-use data structures and data analysis tools
  • pyparsing: general parsing module
  • lxml: most feature-rich and easy-to-use library for working with XML and HTML in the Python language
  • Whoosh: fast, featureful full-text indexing and searching library implemented in pure Python
  • Pexpect: control and automate other programs, similar to Don Libes `Expect` system
  • SikuliX, visual technology to search and automate GUIs using screenshots. Scriptable in
  • PyQt and PySide: Python bindings for the Qt application framework and GUI library

Books

More stuff