Pentesting Python Packages

androguard

Reverse engineering and pentesting for Android applications

fake-http-header

A python package to generate random request fields for a http header.

maigret

🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites

sqlmap

Automatic SQL injection and database takeover tool

sherlock-project

Hunt down social media accounts by username across social networks

bbot

The recursive internet scanner for hackers. 🧡

flask-unsign

Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.

myjwt

A cli for cracking, testing vulnerabilities on Json Web Token(JWT)

ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

radixtarget

RadixTarget is a performant radix implementation designed for quick lookups of IP addresses/networks and DNS hostnames.

dirsearch

Web path scanner

flask-unsign-wordlist

The following package is the standalone wordlist-only component to flask-unsign.

fray

Open-source WAF Security Testing Platform — 7,200+ attack payloads, 98 WAF/CDN fingerprints, AI-powered bypass engine, recon pipeline, beautiful CLI output

opendoor

OWASP Web Recon & Directory Discovery Platform

social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

filelock-lts

Filelock LTS: Security patches for CVEs and long-term support for unsupported Python versions (3.7-3.9).

exegol

Fully featured and community-driven hacking environment

ptai

Offensive-security MCP server with 205 wrapped tools, 17 specialist agents, and 60 SPA-aware probes for OWASP Top 10. CLI + MCP, BYO LLM. No API key needed on MCP path.

secator

secator - the pentester's swiss knife

adscan

Free Active Directory pentesting tool and Linux CLI for AD enumeration, BloodHound, Kerberoasting, ADCS, DCSync, and attack paths.

netcat

pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)

zapcli

A simple tool for interacting with OWASP ZAP from the commandline.

faradaysec

Open Source Vulnerability Management Platform

slowloris

Low bandwidth DoS tool. Slowloris rewrite in Python.