Penetration Testing Python Packages

flask-unsign

Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.

mockssh

Mock an SSH server and define all commands it supports (Python, Twisted)

dirsearch

Web path scanner

adpentest

Active Directory penetration testing framework with automatic Domain Controller detection

wasm-tools

A WebAssembly parser and disassembler in python.

flask-unsign-wordlist

The following package is the standalone wordlist-only component to flask-unsign.

exegol

Fully featured and community-driven hacking environment

clairvoyance

Obtain GraphQL API schema even if the introspection is disabled

adscan

Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.

ziran

ZIRAN finds the vulnerabilities in AI agents that come from tools combining, not from any single prompt. Graph-based tool chain discovery, execution-level side-effect detection, multi-phase campaigns.

phantom-agent

Autonomous Offensive Security Intelligence AI-powered multi-agent penetration testing

bane

The "bane" Python library stands out as a robust toolkit catering to a wide spectrum of cybersecurity and networking tasks. Its versatile range of functionalities covers various aspects, including bruteforce attacks, cryptographic methods, DDoS attacks, information gathering, botnet creation and management, and CMS vulnerability scanning and more..

faradaysec

Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.

pentool

A modern, console-based web penetration testing toolkit with a TUI. Features an HTTP/HTTPS proxy, active/passive vulnerability scanner, Repeater, Intruder, Spider, and more. Free & open-source.

deluluscan

AI-augmented, evidence-first security auditor for authorized testing — web, API, LLM/AI, container, cloud & source code. Pluggable AI (Claude/OpenAI/DeepSeek/Ollama), agentic exploitation, deep verification, multi-format reports. AGPL-3.0.

ptai

Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.

oida-ics

Scan, fuzz, and assess OT protocols from one CLI.

bluecrack

A Tool For BruteForce (Ethically)

zapcli

A simple tool for interacting with OWASP ZAP from the commandline.

ssh-mitm

SSH-MITM - ssh audits made simple

vulnclaw

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排， 配合大语言模型， 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

agentic-bug-hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

netcat

pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)

knock-subdomains

Knock Subdomain Scan