Pentesting Python Packages

csp-toolkit

Content Security Policy analysis, bypass detection, and CI gating. 21 weakness checks with A+ to F grading, 79 known bypass domains, SARIF output, and a GitHub Action.

androguard

Reverse engineering and pentesting for Android applications

fake-http-header

A python package to generate random request fields for a http header.

bbot

The recursive internet scanner for hackers. 🧡

sherlock-project

Hunt down social media accounts by username across social networks

maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

flask-unsign

Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.

sqlmap

Automatic SQL injection and database takeover tool

radixtarget

RadixTarget is a performant radix implementation designed for quick lookups of IP addresses/networks and DNS hostnames.

myjwt

A cli for cracking, testing vulnerabilities on Json Web Token(JWT)

dirsearch

Web path scanner

user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

flask-unsign-wordlist

The following package is the standalone wordlist-only component to flask-unsign.

secator

secator - the pentester's swiss knife

websec-validator

Local-first security recon for AI coding agents: map attack surfaces, stage tailored probes, and produce a fact-grounded brief. Part of the Guard family with DocGuard and TestGuard.

decepticon

Autonomous Hacking Agent for Red Team

exegol

Fully featured and community-driven hacking environment

decepticon-core

Autonomous Hacking Agent for Red Team

social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

decepticon-sdk

Autonomous Hacking Agent for Red Team

ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

adscan

Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.

ziran

ZIRAN finds the vulnerabilities in AI agents that come from tools combining, not from any single prompt. Graph-based tool chain discovery, execution-level side-effect detection, multi-phase campaigns.

vamp-secrets-scanner

Static secrets scanner — 271 patterns across 9 YAML rule files (cloud, AI APIs, CI/CD, SaaS, hardware, web3), git history, Docker, K8s, SARIF, --delta