Web Security Python Packages

secure

Modern Python library for HTTP security headers with safe defaults, configurable presets, and first-class ASGI/WSGI middleware (FastAPI, Django, Flask, Shiny, and more).

cors

🎯 Fast CORS misconfiguration vulnerabilities scanner

requests-ip-rotator

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.

backpropagate

Headless LLM fine-tuning in 3 lines — smart defaults, VRAM-aware batch sizing, multi-run SLAO, GGUF export for Ollama.

mobsf

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

pentool

A modern, console-based web penetration testing toolkit with a TUI. Features an HTTP/HTTPS proxy, active/passive vulnerability scanner, Repeater, Intruder, Spider, and more. Free & open-source.

fastapi-csp-docs

CSP-safe replacements for FastAPI's built-in /docs, /redoc, and OAuth2 redirect endpoints, with no inline script or style, so a strict Content-Security-Policy still works

webvigil

🔎 In-band web application vulnerability scanner for developers: a reusable engine, a CLI, and an optional dashboard. Passive and production-safe by default; opt-in Active Mode for XSS, SQLi, SSRF, RCE, XXE, upload and more — every finding confirmed against a baseline.

vamp-http-audit

VampSecure Labs — HTTP Security Headers & CORS Auditor

rcekit

Test a URL or captured HTTP request for RCE—and know what the evidence actually proves. RCEKit checks command injection, SSTI and blind paths, separates confirmed execution from uncertain signals and untested runs, and generates targeted payloads for Burp, ffuf and Nuclei. One Python file; no third-party dependencies.

sloptic

Web app slop checker

moonito

Lightweight Python SDK for Moonito visitor analytics and filtering. Protect web apps from bots and malicious traffic. Works with Flask, Django, FastAPI.

githacker

🕷️ A `.git` folder exploiting tool that is able to restore the entire Git repository, including stash, common branches and common tags.

arcis

Inside-the-app security middleware for Node.js, Python, and Go. 20+ attack vectors. One install, three languages, MIT.

corscanner

🎯 Fast CORS misconfiguration vulnerabilities scanner

breachsql

Fast SQL injection scanner with built-in exploitation — detect and extract in one command, across all major backends, with WAF evasion baked in.

secautoban

恶意IP全自动封禁平台。支持收集如下安全设备告警：长亭WAF社区版（SafeLine）、微步蜜罐HFish、奇安信天眼、奇安信椒图、绿盟WAF、天融信WAF、科来网络安全分析审计系统、深信服态势感知、启明星辰全网安全态势感知系统。支持如下设备联动封禁：RouterOS、OPNsense、CheckPoint、旁路阻断（无需设备配合）、BGP、奇安信防火墙、天融信防火墙、深信服防火墙。

agentview-cli

See the web the way an AI agent sees it - measure where sites serve AI crawlers a different, sometimes poisoned, page.

hunterxsec

AI-Assisted Vulnerability Discovery, Validation & Proof Engine

webenum-ng

All-in-one web recon orchestrator (the "enum4linux-ng of the web"): parallel fingerprint, content discovery, vuln scan and CMS tools, with product-aware nuclei and prioritized next-step recommendations.

surface-audit

Deterministic security smoke tests for preview, staging, and pre-deploy web URLs.

pyhtools

A Python Hacking Library consisting of network scanner, arp spoofer and detector, dns spoofer, code injector, packet sniffer, network jammer, email sender, downloader, wireless password harvester credential harvester, keylogger, download&execute, ransomware, data harvestors, etc.

ubag

Open reference implementation: agent identity + routing at the web edge (Ed25519 + ES256/JWKS). Python & Node.

brs-xss

MIT license BRS-XSS is a modular Python CLI scanner for XSS vulnerabilities. Features context-aware payloads, WAF evasion, DOM analysis via Playwright, ML-based risk scoring, and export in HTML/JSON/SARIF. Designed for integration with Brabus Recon Suite (BRS).