Command Injection Python Packages

rcekit

Test a URL or captured HTTP request for RCE—and know what the evidence actually proves. RCEKit checks command injection, SSTI and blind paths, separates confirmed execution from uncertain signals and untested runs, and generates targeted payloads for Burp, ffuf and Nuclei. One Python file; no third-party dependencies.

wshawk

Open source toolkit for WebSocket security testing, web application penetration testing, and stateful attack validation. It combines a CLI scanner, web dashboard, Electron desktop app, browser companion, and project-backed workflows for authorized security assessments.

sh-guard

Semantic shell command safety classifier — AST-based risk scoring for AI coding agents

polyglot-bug-hunter-x

Multimodal AI web bug hunter: sees, hears and reads a website while hunting bugs. 43 non-destructive payloads, CVSS v3.1 scoring, offline demo, CLI, Kaggle kernel.

deadwood-sec

A self-hosted, leveled web-security range (tutorial → impossible) — the practice town for wraith & hickok. Intentionally vulnerable; localhost only.

waymap

Waymap is a fast and optimized web vulnerability scanner built for penetration testers. It helps in identifying vulnerabilities by testing against various payloads.

mcpsnare

Active security scanner that pentests MCP (Model Context Protocol) servers. Triggers and out-of-band-confirms real vulns (RCE, SSRF, path traversal, auth bypass) with graded confidence. Like Burp's Active Scan, but the target is an MCP server. stdio + HTTP.

lfimap

Local File Inclusion discovery and exploitation tool

netshell

A lightweight HTTP CLI Shell that enables custom command injection into vulnerable web applications with a familiar shell-like interface.

t2i-skillguard

Security scanner for AI skill files (SKILL.md) and bundled code (scripts/, tools/). It helps you catch high-risk patterns before publishing or running a skill.