Pentesting Python Packages

androguard

Reverse engineering and pentesting for Android applications

fake-http-header

A python package to generate random request fields for a http header.

sherlock-project

Hunt down social media accounts by username across social networks

maigret

🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites

flask-unsign

Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.

bbot

The recursive internet scanner for hackers. 🧡

sqlmap

Automatic SQL injection and database takeover tool

radixtarget

RadixTarget is a performant radix implementation designed for quick lookups of IP addresses/networks and DNS hostnames.

myjwt

A cli for cracking, testing vulnerabilities on Json Web Token(JWT)

ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

dirsearch

Web path scanner

flask-unsign-wordlist

The following package is the standalone wordlist-only component to flask-unsign.

decepticon

Autonomous Hacking Agent for Red Team

decepticon-sdk

Autonomous Hacking Agent for Red Team

fray

Open-source WAF Security Testing Platform — 7,200+ attack payloads, 98 WAF/CDN fingerprints, AI-powered bypass engine, recon pipeline, beautiful CLI output

decepticon-core

Autonomous Hacking Agent for Red Team

social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

aicu-scanner

Black-box security scanner for LLM applications — prompt injection, safety bypass, credential leakage

secator

secator - the pentester's swiss knife

ptai

Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.

embedxpl

Embedded Device Security Assessment Framework — 700 modules, 350 CVEs, 55 vendors, APT Group Engine. Covers routers, IP cameras, GPON ONTs, ISP CPEs, IoT/embedded edge.

d0rk3r

Shodan IP scraper with auto-proxy rotation. No API key needed. Perfect for OSINT, bug bounty & pentesting.

mcppt

MCPTROTTER - 28 automated security checks for any MCP server

adscan

Active Directory pentesting tool for Linux. Automated Kerberoasting, AS-REP Roasting, ADCS/ESC exploitation, DCSync, BloodHound integration, and 40+ AD attack paths. ENS Alto / NIS2 / ISO 27001 compliance reports. No Windows required.