Python Pentesting

Open-source Python projects categorized as Pentesting

Top 23 Python Pentesting Projects

  • SQLMap

    Automatic SQL injection and database takeover tool

  • Project mention: Best Hacking Tools for Beginners 2024 | | 2024-02-01


  • Ciphey

    ⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

  • Project mention: CyberChef from GCHQ: The Cyber Swiss Army Knife | | 2024-02-01

    I also discovered Ciphey. Neat little tool indeed, but it's being deprecated. It's mentioned in this issue[1] and being replaced with Ares[2]. Neither could decipher this strange encryption[3] I used it on :(



    [3] "dEFLWWFKQWxRQW16RnkvbTZML0lsdz09" original text is "hacker"

  • InfluxDB

    Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

    InfluxDB logo
  • spiderfoot

    SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

  • owasp-mastg

    The Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Security Verification Standard (MASVS).

  • Project mention: More ways to identify independently security tested apps on Google Play | | 2023-11-03
  • dirsearch

    Web path scanner

  • Project mention: Looking for some help with this Python package | /r/learnpython | 2023-08-19

    I am new to Python. With the help of several users (thanks u/Diapolo10 and u/shiftybyte)I've been able to install Python and the dirsearch package. Dirsearch ( allows for checking website paths with a wordlist. For example, I have a wordlist file with words like "dog", "cat", "bird", etc and I want to check the validity of those words as extensions on a website. Something like "", "", etc. I have a test wordlist in the same directory as dirsearch, but I am confused on how to proceed with the commands. I want to have it check my wordlist as extensions on the website and then save output on if the webpath is valid or not. Just need a little bit of help.

  • hacktricks

    Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

  • Project mention: Where do you look for help when doing ctf | /r/Hacking_Tutorials | 2023-06-08
  • pupy

    Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

  • WorkOS

    The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

    WorkOS logo
  • rengine

    reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

  • Project mention: Any self-host FOSS suites for running phishing testing campaigns? | /r/selfhosted | 2023-05-21

    I couldn't find anything named reEngine, but I found reNgine ( ) which I think is what you meant.

  • DefaultCreds-cheat-sheet

    One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️

  • androguard

    Reverse engineering and pentesting for Android applications

  • faraday

    Open Source Vulnerability Management Platform (by infobyte)

  • commix

    Automated All-in-One OS Command Injection Exploitation Tool.

  • PhoneSploit-Pro

    An all-in-one hacking tool to remotely exploit Android devices using ADB and Metasploit-Framework to get a Meterpreter session.

  • drozer

    The Leading Security Assessment Framework for Android.

  • Villain

    Villain is a C2 framework that can handle multiple TCP socket & HoaxShell-based reverse shells, enhance their functionality with additional features (commands, utilities etc) and share them among connected sibling servers (Villain instances running on different machines).

  • bbot

    A recursive internet scanner for hackers.

  • Project mention: [GitHub Action]: Wrappers for sqlmap, bbot and nikto | /r/cybersecurity | 2023-05-29

    Its not that much of a tool than wrappers of few awesome tools that most of you probably know and use today - sqlmap, bbot and nikto.

  • pocsuite3

    pocsuite3 is an open-sourced remote vulnerability testing framework developed by the Knownsec 404 Team.

  • Raccoon

    A high performance offensive security tool for reconnaissance and vulnerability scanning

  • malicious-pdf

    💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or

  • Project mention: Securing PDF Generators Against SSRF Vulnerabilities | /r/netsec | 2023-05-30

    Wrote a tool two years ago that does some of the PDF-tests. But more could be added:

  • slowloris

    Low bandwidth DoS tool. Slowloris rewrite in Python.

  • blackbird

    An OSINT tool to search for accounts by username in social networks. (by p1ngul1n0)

  • EvilOSX

    An evil RAT (Remote Administration Tool) for macOS / OS X.

  • CloudFail

    Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

  • SaaSHub

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

    SaaSHub logo
NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020). The latest post mention was on 2024-02-01.

Python Pentesting related posts


What are some of the best open-source Pentesting projects in Python? This list will help you:

Project Stars
1 SQLMap 30,495
2 Ciphey 16,920
3 spiderfoot 11,670
4 owasp-mastg 11,254
5 dirsearch 11,179
6 hacktricks 8,125
7 pupy 8,116
8 rengine 6,685
9 DefaultCreds-cheat-sheet 5,256
10 androguard 4,916
11 faraday 4,600
12 commix 4,318
13 PhoneSploit-Pro 4,165
14 drozer 3,592
15 Villain 3,561
16 bbot 3,489
17 pocsuite3 3,486
18 Raccoon 2,993
19 malicious-pdf 2,585
20 slowloris 2,333
21 blackbird 2,245
22 EvilOSX 2,171
23 CloudFail 2,117
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives