python-pentest-tools - 渗透测试人员的Python工具

项目说明

Python tools for penetration testers
====================================

If you are in in research, reverse engineering or
pentesting, I suggest to try out the
Python programming language. It has a rich set
of useful libraries and programs. This page lists some of them.

Most of the listed tools are written in Python, others are just Python
bindings for existing C libraries, i.e. they make those libraries easily
usable from Python programs.

Some of the more aggressi (pentest frameworks, bluetooth
smashers, web application scanners, war-dialers, etc.) are
left out, because the legal situation of these tools is still a bit
unclear in Germany -- e the decision of the highest
court.
This list is clearly meant to help whitehats, and for now I prefer to
err on the safe side.

Network

Scapy: send, sniff and dissect

and forge 网络 packets. Usable interactively or as a library

Darkmoon : Open 源码 (GPL-3.0) autonomous AI penetration testing platform co web, API, Acti and Kubernetes, with proof of exploitation.

Impacket:

craft and decode 网络 packets. Includes support for higher-level
protocols such as NMB and SMB

SMBMap:

enumerate Samba share dri an entire domain

dpkt: fast, simple packet

creation/parsing, with definitions for the basic TCP/IP protocols

AutoRecon: Multi-threaded 网络 reconnaissance 工具

Mitm6: IP MITM 工具 that exploits IPv6 features to conduct man-in-the-middle attacks

Habu:

python network hacking toolkit

Knock Subdomain Scan, enumerate

subdomains on a target domain through a wordlist

SubBrute, fast subdomain

enumeration tool

pypcap,

Pcapy,
Pcapy-NG and
libpcap: several different
Python bindings for libpcap

libdnet: low-le

routines, including interface lookup and Ethernet frame transmission

Mallory, extensible

TCP/UDP man-in-the-middle proxy, supports modifying non-standard
protocols on the fly

Pytbull-NG: flexible IDS/IPS testing

框架 (shipped with more than 300 tests)

Spoodle: A mass subdomain + poodle

scanner

BloodHound.py: Python alternative to BloodHound for AD enumeration, Mapping attack paths in AD.

Debugging and reverse engineering

Frida: A dynamic instrumentation 框架 which can

inject scripts into running processes

Capstone: lightweight

multi-platform, multi-architecture disassembly 框架 with Python
bindings

Unicorn 引擎: CPU emulator 框架 with Python bindings

Androguard: reverse

engineering and analysis of Android applications

Paimei: reverse engineering

framework, includes PyDBG, PIDA,
pGRAPH

IDAPython: IDA Pro plugin that

integrates the Python programming language, allowing scripts to run
in IDA Pro

PyEMU: fully scriptable IA-32

emulator, useful for malware analysis

pefile: read and work with

Portable Executable (aka PE) files

pydasm:

Python interface to the libdasm
x86 disassembling library

PyDbgEng: Python wrapper for the

Microsoft Windows Debugging Engine

diStorm: disassembler library

for AMD64, licensed under the BSD license

python-ptrace:

debugger using ptrace (Linux, BSD and Darwin system call to trace
processes) written in Python

Keystone: lightweight multi-platform,

multi-architecture assembler 框架 with Python bindings

PyBFD: Python interface

to the GNU Binary File Descriptor (BFD) library

CHIPSEC: framework for analyzing the

security of PC platforms including hardware, system firmware (BIOS/UEFI),
and platform components.

Ghidatron: The FLARE team's open-源码 extension to add Python 3 scripting to Ghidra.

PyMemoryEditor: read,

write and scan the memory of running processes on Windows, Linux and
macOS, in pure Python (ctypes), with Cheat 引擎-style value scans and
pointer chains

Fuzzing

afl-python: enables American fuzzy

lop fork 服务端 and instrumentation for pure-Python 代码

Sulley: fuzzer de and

fuzz testing 框架 consisting of multiple extensible components

Peach Fuzzing Platform:

extensible fuzzing 框架 for generation and mutation based
fuzzing (v2 was written in Python)

untidy: general purpose XML fuzzer

Powerfuzzer: highly automated and

fully customizable web fuzzer (HTTP 协议 based application
fuzzer)

Construct: library for parsing

and building of data structures (binary or textual). Define your
data structures in a declarati

Fusil: Python library

used to write fuzzing programs

Web

XSStrike: Ad XSS detection suite

Requests: elegant and simple HTTP

library, built for human beings

lxml: easy-to-use library for processing XML and HTML; similar to Requests

HTTPie: human-friendly cURL-like command line

HTTP client

Twill: browse the Web from a command-line

interface. Supports automated Web testing

FunkLoad: functional and load web

tester

spynner: Programmatic web

browsing module for Python with Ja/AJAX support

mitmproxy: SSL-capable, intercepting HTTP

proxy. Console interface allows traffic flows to be inspected and
edited on the fly

spidy: simple command-line web crawler with page downloading and word scraping

web scanner built for penetration testers

Forensics

:

extract digital artifacts from memory (RAM) samples

Rekall:

memory analysis framework de by Google

TrIDLib, identify file types

from their binary signatures. Now includes Python binding

Malware analysis

pyew: command line hexadecimal

editor and disassembler, mainly to analyze malware

Exefilter: filter file formats

in e-mails, web pages or files. Detects many common file formats and
can remo content

jsunpack-n, generic

Ja unpacker: emulates browser functionality to detect
exploits that target browser and browser plug-in

yara-python:

identify and classify malware samples

phoneyc: pure Python

honeyclient implementation

CapTipper: analyse, explore and

revive HTTP malicious traffic from PCAP file

Cuckoo: Automated malware analysis system

CAPE: Malware configuration and payload extraction

PDF

pdfminer.six:

extract text from PDF files

peepdf-3:

Python 工具 to analyse and explore PDF files to find out if they can be harmful

Didier Stevens' PDF

tools: analyse,
identify and create PDF files

pyPDF: pure Python PDF toolkit: extract

info, spilt, merge, crop, encrypt, decrypt...

Misc

Angr: Powerful binary analysis 框架 for research and exploit de

ScoutSuite: Multi-cloud security auditing 工具

Exomind:

框架 for building decorated graphs and de open-源码
intelligence modules and ideas, centered on social 网络 services,
search engines and instant messaging

simplejson: JSON

encoder/decoder, e.g. to use Google's AJAX
API

PyMangle: command line tool

and a python library used to create word lists for use with other
penetration testing tools

Hachoir: view and

edit a binary stream field by field

py-mangle: command line tool

and a python library used to create word lists for use with other
penetration testing tools

wmiexec.py:

execute Powershell commands quickly and easily via WMI

Pentestly:

Python and Powershell internal penetration testing 框架

hacklib:

Toolkit for hacking enthusiasts: word mangling, password guessing,
reverse shell and other simple tools

Certipy: Acti Certificate Services enumeration and abuse 工具

BloodHound.py: Python-based BloodHound ingestor for Acti security assessment

Other useful libraries and tools

Project Jupyter: enhanced interactive

shell with many features for object introspection, system shell
access, and its own special command system

Beautiful Soup:

HTML parser optimized for screen-scraping

matplotlib: make 2D plots of

arrays

Mayavi: 3D scientific

data and plotting

RTGraph3D: create

dynamic graphs in 3D

Twisted: e networking engine

Suds: lightweight SOAP client for

consuming Web Services

NetworkX: graph library (edges, nodes)

Pandas: library pro

high-performance, easy-to-use data structures and data analysis
tools

pyparsing: general parsing

module

lxml: most feature-rich and easy-to-use library

for working with XML and HTML in the Python language

Whoosh: fast, featureful

full-text indexing and searching library implemented in pure Python

Pexpect: control and automate

other programs, similar to Don Libes \Expect\ system

SikuliX, technology

to search and automate GUIs using screenshots. Scriptable in

PyQt and

PySide: Python bindings for the Qt
application framework and GUI library

Books

Python by TJ O'Connor. A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers

Grey Hat Python by Justin Seitz:

Python Programming for Hackers and Reverse Engineers.

Black Hat Python by Justin Seitz:

Python Programming for Hackers and Pentesters

Python Penetration Testing Essentials by Mohit:

Employ the power of Python to get the best out of pentesting

Python for Secret Agents by Steven F. Lott. Analyze, encrypt, and unco data using Python

Python Web Penetration Testing Cookbook by Cameron Buchanan et al.: Over 60 Python recipes for web application testing

Learning Penetration Testing with Python by Christopher Duffy: Utilize Python scripting to execute effective and efficient penetration tests

Python Forensics by Chet Hosmer:

A Workbench for In and Sharing Digital Forensic Technology

The Beginner's Guide to IDAPython by Alexander Hanel

Python for Offensi: A Practical Guide to Ethical Hacking and Penetration Testing Using Python by Hussam Khrais

More stuff

SecurityTube Python Scripting Expert (SPSE) is an online course and certification offered by Vi.

SANS offers the course SEC573: Automating Information Security with Python.

There is a SANS paper about Python libraries helpful for forensic analysis

(PDF).

For more Python libaries, please have a look at

PyPI, the Python Package Index.

项目信息

开发语言：未知

Star 数：2889

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Python tools for penetration testers展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。