SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 Python Pentest Projects
-
PayloadsAllTheThings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
-
AppSignal
Monitoring that respects your time & budget. APM, error tracking, and dashboards for modern web apps. Ten-minute setup, transparent flat pricing, and support from engineers who actually use the product.
-
-
DefaultCreds-cheat-sheet
One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️
-
-
Villain
Villain is a high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality with additional features (commands, utilities) and share them among connected sibling servers (Villain instances running on different machines).
-
Project mention: Snoop Project Update (search for usernames on 5k websites) | news.ycombinator.com | 2026-01-01
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
pentest-wiki
PENTEST-WIKI is a free online security knowledge library for pentesters / researchers. If you have a good idea, please share it with others.
-
CloudFlair
🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.
-
reconspider
🔎 Most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations.
-
CloudFail
Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network
-
SysReptor
A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.
-
-
owtf
Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient http://owtf.org https://twitter.com/owtfp
Project mention: From Sandbox to Review Queue: My GSoC 2026 Project with OWASP OWTF | dev.to | 2026-08-21What got shipped: Six pull requests against owtf/owtf, around 6,000 lines of Python and TypeScript, 153 backend unit tests, and a trust model doc.
-
pyrdp
RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
-
-
GraphQLmap
GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. - Do not use for illegal testing ;)
-
-
enum4linux-ng
A next generation version of enum4linux (a Windows/Samba enumeration tool) with additional features like JSON/YAML export. Aimed for security professionals and CTF players.
-
-
-
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Python Pentest discussion
Python Pentest related posts
-
Snoop Project Update (search for usernames on 5k websites)
-
Irish-Name-Repo 2 - picoCTF '19 (web)
-
List of Useful Payloads and Bypass for Web Application Security and Pentest/CTF
-
PayloadsAllTheThings: Essential Payloads and Bypass for Web Security and CTFs
-
Hack The Box Writeup: Heist
-
Osint update of the Snoop Project tool search for user by nickname
-
php shell not executed in wordpress
-
A note from our sponsor - SaaSHub
www.saashub.com | 8 Oct 2026
Index
What are some of the best open-source Pentest projects in Python? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | PayloadsAllTheThings | 81,537 |
| 2 | objection | 9,423 |
| 3 | DefaultCreds-cheat-sheet | 6,766 |
| 4 | NetExec | 5,907 |
| 5 | Villain | 4,429 |
| 6 | snoop | 4,040 |
| 7 | patator | 3,919 |
| 8 | pentest-wiki | 3,768 |
| 9 | CloudFlair | 2,965 |
| 10 | reconspider | 2,813 |
| 11 | CloudFail | 2,687 |
| 12 | SysReptor | 2,593 |
| 13 | pwn_jenkins | 2,097 |
| 14 | owtf | 1,960 |
| 15 | pyrdp | 1,784 |
| 16 | odat | 1,779 |
| 17 | GraphQLmap | 1,690 |
| 18 | SSTImap | 1,679 |
| 19 | enum4linux-ng | 1,669 |
| 20 | Redcloud | 1,276 |
| 21 | VcenterKit | 1,276 |
| 22 | BeeLogger | 1,170 |
| 23 | pywerview | 1,136 |
Sponsored
Monitoring that respects your time & budget
APM, error tracking, and dashboards for modern web apps. Ten-minute setup, transparent flat pricing, and support from engineers who actually use the product.
www.appsignal.com