Penetration Testing Python Packages

flask-unsign

Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.

101K 652 47

dirsearch

Web path scanner

30K 14K 2K

flask-unsign-wordlist

The following package is the standalone wordlist-only component to flask-unsign.

23K 44 13

mockssh

Mock an SSH server and define all commands it supports (Python, Twisted)

22K 130 25

fray

Open-source WAF Security Testing Platform — 7,200+ attack payloads, 98 WAF/CDN fingerprints, AI-powered bypass engine, recon pipeline, beautiful CLI output

13K 50 4

wasm-tools

A WebAssembly parser and disassembler in python.

8K 0 0

clairvoyance

Obtain GraphQL API schema even if the introspection is disabled

7K 1K 134

phantom-agent

Autonomous Offensive Security Intelligence AI-powered multi-agent penetration testing

6K 15 4

ptai

Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.

6K 1K 242

vulnclaw

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排，配合大语言模型，自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

6K 2K 245

adscan

Active Directory pentesting tool for Linux. Automated Kerberoasting, AS-REP Roasting, ADCS/ESC exploitation, DCSync, BloodHound integration, and 40+ AD attack paths. ENS Alto / NIS2 / ISO 27001 compliance reports. No Windows required.

5K 470 50

exegol

Fully featured and community-driven hacking environment

5K 3K 280

ziran

自然 ZIRAN is an open-source security testing framework for AI agents. It discovers dangerous tool chain compositions via knowledge graph analysis, detects execution-level side effects (not just text output), and runs multi-phase trust exploitation campaigns that model real attacker behaviour.

4K 9 2

bane

The "bane" Python library stands out as a robust toolkit catering to a wide spectrum of cybersecurity and networking tasks. Its versatile range of functionalities covers various aspects, including bruteforce attacks, cryptographic methods, DDoS attacks, information gathering, botnet creation and management, and CMS vulnerability scanning and more..

4K 357 70

zapcli

A simple tool for interacting with OWASP ZAP from the commandline.

4K 261 70

netcat

pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)

3K 2K 216

ssh-mitm

SSH-MITM - ssh audits made simple

3K 1K 155

phantomsignal

Open-source OSINT intelligence framework — nmap-powered port scanning with OS detection, rich CLI panels, DNS recon, tech fingerprinting, 30+ threat intel APIs, Shadow Profiler, and cyberpunk web UI. pip install phantomsignal

3K 1 0