Python Security

Open-source Python projects categorized as Security

Top 23 Python Security Projects

  • PayloadsAllTheThings

    A list of useful payloads and bypass for Web Application Security and Pentest/CTF

    Project mention: php shell not executed in wordpress | /r/hacking | 2023-12-08

    Also https://github.com/swisskyrepo/PayloadsAllTheThings I'm sure there's a few test php files in here for filter bypasses too

  • mitmproxy

    An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

    Project mention: Ask HN: Fiddler Alternatives | news.ycombinator.com | 2024-03-14
  • InfluxDB

    Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  • SQLMap

    Automatic SQL injection and database takeover tool

    Project mention: Best Hacking Tools for Beginners 2024 | dev.to | 2024-02-01

    sqlmap

  • CheatSheetSeries

    The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

    Project mention: Next.js: consequence of AppRouter on your CSP | dev.to | 2024-03-07

    Cross Site Scripting Prevention Cheat Sheet from OWASP Cheat Sheet Series

  • hosts

    🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.

    Project mention: Does PiHole block porn? | /r/pihole | 2023-12-06

    Not by default but a blocklist can be found here https://github.com/StevenBlack/hosts

  • macOS-Security-and-Privacy-Guide

    Guide to securing and improving privacy on macOS

    Project mention: Hardening macOS | /r/MacOS | 2023-07-03
  • wifiphisher

    The Rogue Access Point Framework

  • WorkOS

    The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  • routersploit

    Exploitation Framework for Embedded Devices

  • dirsearch

    Web path scanner

    Project mention: Looking for some help with this Python package | /r/learnpython | 2023-08-19

    I am new to Python. With the help of several users (thanks u/Diapolo10 and u/shiftybyte)I've been able to install Python and the dirsearch package. Dirsearch (https://github.com/maurosoria/dirsearch) allows for checking website paths with a wordlist. For example, I have a wordlist file with words like "dog", "cat", "bird", etc and I want to check the validity of those words as extensions on a website. Something like "example.com/bird", "example.com/cat", etc. I have a test wordlist in the same directory as dirsearch, but I am confused on how to proceed with the commands. I want to have it check my wordlist as extensions on the example.com website and then save output on if the webpath is valid or not. Just need a little bit of help.

  • DB-GPT

    AI Native Data App Development framework with AWEL(Agentic Workflow Expression Language) and Agents

    Project mention: (2/2) May 2023 | /r/dailyainews | 2023-06-02

    Interact your data and environment using the local GPT (https://github.com/csunny/DB-GPT)

  • urh

    Universal Radio Hacker: Investigate Wireless Protocols Like A Boss

    Project mention: Flipper Zero: Multi-Tool Device for Geeks | news.ycombinator.com | 2024-01-21

    >> or somewhat expensive and complex SDR

    I don’t think that’s as accurate today as it used to be.

    On the hardware side there are tons of options very cheaply available - iirc the flipper uses the c1100 (or a number like that) it’s a popular cheap chip and it’s well documented and interfaces easily with arduino.

    More accessibly, lime mini SDRs are cheap but there’s quite a few alternatives too.

    On the software side GNU Radio is free with decent tutorials - we’re not talking anything like blender levels of difficulty to adopt even if it is a complex domain.

    Although on the more accessible side, urh is incredibly powerful given how easy to use it is https://github.com/jopohl/urh

    I used the latter to tap into a 2 channel wireless bbq thermometer via a $10 rtl sdr and that was a breeze, an absolute walk in the park compared to when I reverse engineered the flysky telemetry system.

  • Fail2Ban

    Daemon to ban hosts that cause multiple authentication errors

    Project mention: Looking for a way to remote in to K's of raspberry pi's... | /r/sysadmin | 2023-12-10

    now some things you need to think about: - cloud init - this will need to be secure so lock it down hard anything not needed an alternative OS to look at if you have the ability's is https://www.alpinelinux.org/ also as these devices are not that powerfull every extra agent / abstaction layer you add impacts performance need to look at low over head security https://www.crowdsec.net/ and https://github.com/fail2ban/fail2ban (if you call fail2ban security) - using certificates to authenticate ssh login

  • scapy

    Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.

    Project mention: Seven Python Projects to Elevate Your Coding Skills | dev.to | 2024-02-15

    Example Network Scanner Scapy

  • mvt

    MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

    Project mention: Exploiting the iPhone 4 | news.ycombinator.com | 2023-10-02

    Amnesty International released Mobile Verification Toolkit to check your phone for malware, by checking encrypted backups on your computer. https://github.com/mvt-project/mvt

  • opensnitch

    OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.

    Project mention: Is Linux worth it for the average non-tech user? | /r/privacy | 2023-12-10
  • prowler

    Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more

    Project mention: Ask HN: Cloud security auditing for indie-grade projects? | news.ycombinator.com | 2023-12-04

    Which cloud provider?

    https://github.com/prowler-cloud/prowler is easy to get going with, and gives decent results. It's much stronger at AWS than GCP or Azure.

    Steampipe can be a little harder to wrap your head around, but scales really well and has broader support: https://hub.steampipe.io/mods?objectives=security

  • Mailpile

    A free & open modern, fast email client with user-friendly encryption and privacy features

    Project mention: [Self Hosted] Selbst gehostete Mailserver: mailcow, mailinabox, mailU... hast du sie (eingehend) getestet? Ihre Meinung und Ratschläge hier, danke! | /r/aufdeutsch | 2023-04-27
  • trape

    People tracker on the Internet: OSINT analysis and research tool by Jose Pino

    Project mention: TRACK PEOPLE ON THE INTERNET: Learn to track your opps world, to avoid being traced | /r/make_money_online_vip | 2023-06-16

    Github Link

  • sigma

    Main Sigma Rule Repository

    Project mention: Sigma rules in real life | /r/cybersecurity | 2023-10-14

    Sigma rules https://github.com/SigmaHQ/sigma its value, I get it. Here’s a post https://www.linkedin.com/posts/nasreddinebencherchali_detection-blueteam-sigma-activity-7104868070069817344-mn91?utm_source=share&utm_medium=member_desktop detailing that 31 Sigma rules from the Sigma repository are triggering on different stages of the attack as described here https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/

  • objection

    📱 objection - runtime mobile exploration

  • frappe

    Low code web framework for real world applications, in Python and Javascript

  • pyWhat

    🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

  • ScoutSuite

    Multi-Cloud Security Auditing Tool

    Project mention: Azure and M365 Secure Config Review | /r/Pentesting | 2023-05-31

    Prowler and ScoutSuite are a good start for cloud stuff.

  • SaaSHub

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020). The latest post mention was on 2024-03-14.

Python Security related posts

Index

What are some of the best open-source Security projects in Python? This list will help you:

Project Stars
1 PayloadsAllTheThings 56,534
2 mitmproxy 34,277
3 SQLMap 30,427
4 CheatSheetSeries 26,411
5 hosts 25,413
6 macOS-Security-and-Privacy-Guide 20,863
7 wifiphisher 12,659
8 routersploit 11,857
9 dirsearch 11,179
10 DB-GPT 10,819
11 urh 10,367
12 Fail2Ban 10,366
13 scapy 10,010
14 mvt 9,772
15 opensnitch 9,633
16 prowler 9,486
17 Mailpile 8,782
18 trape 7,907
19 sigma 7,563
20 objection 6,961
21 frappe 6,445
22 pyWhat 6,346
23 ScoutSuite 6,132
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com