Pentest Python Packages

myjwt

A cli for cracking, testing vulnerabilities on Json Web Token(JWT)

objection

📱 objection - runtime mobile exploration

hickok

Reverse-shell handler & post-exploitation: multi-listener PTY console, payload generation, and a full SQL injection engine (union/boolean/time, native Tor). Python, no core deps.

wraith-sec

Pipeline-based offensive security scanner: recon and web vuln testing (XSS/SQLi/IDOR/BAC), every finding double-confirmed. Python, no core deps.

decepticon

Autonomous Hacking Agent for Red Team

decepticon-sdk

Autonomous Hacking Agent for Red Team

decepticon-core

Autonomous Hacking Agent for Red Team

social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

search-vulns

A modular tool to search for known vulnerabilities, exploits and more across various data sources

deadwood-sec

A self-hosted, leveled web-security range (tutorial → impossible) — the practice town for wraith & hickok. Intentionally vulnerable; localhost only.

netcat

pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)

bypass-url-parser

bypass-url-parser

wfh-wordlist

The most comprehensive wordlist generation toolkit for pentest, red team, and security research. 25 subcommands: charset, profile, corp-users, default-creds, password-dna, DNS fuzzing, web scraping, ISP keygen, ICS/SCADA credentials, ML training, pipal analysis, and more. Python 3.8+ | pip install wfh-wordlist

pyrdp-mitm

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

pywerview

A (partial) Python rewriting of PowerSploit's PowerView

wish-models

Your Wish, Our Command

ywh2bt

YesWeHack BugTracker

faraday-cli

Faraday's Command Line Interface

wpsecscan

Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only.

frida-gadget

Automated tool for patching APKs to enable the use of Frida gadget by downloading the library and injecting code into the main activity.

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

faraday-agent-dispatcher

Faraday Agent Dispatcher launches any security tools and send results to Faradaysec Platform.

r-ascan

Dynamic web security scanner with normalized JSON and HTML reporting

py-nessus-pro

A python implemetation for managing Nessus Professional. It provides support for launching, configuring, monotoring and reporting for scans.