Python Resources

Python sits on both sides of this library

Two distinct bodies of work end up under this tag, and it helps to know which one you are reading. The first is Python as the language security work is written in: request handling, parsing, concurrency, and the small details that separate a script that works once from a tool you can point at a thousand hosts. The second is Python as an attack surface — the features and libraries that introduce vulnerabilities into applications written in it.

On the second: Python's dangerous edges are mostly about evaluation and deserialization. pickle executes code by design, which makes any pickle from an untrusted source equivalent to remote code execution, and it still turns up in caches, session stores and message queues. eval and exec need no explanation; yaml.load without a safe loader is the same bug wearing a configuration file. Format-string and f-string constructs that touch attacker input can reach object internals. Subprocess calls with shell=True are command injection whenever the argument is not fully controlled. Jinja2 SSTI is common enough that it has its own topic on this site, and the escape chains there run through exactly these primitives.

Packaging deserves its own attention. Installing a package runs its build code, dependency confusion against internal index names is a live technique rather than a theoretical one, and typosquatted names on PyPI are a recurring event. If you write Python tooling, pinning and hash-checking your own dependencies is security work, not hygiene theatre.

For tool building, the material here leans practical: async and threading for scanning at scale, working with requests and raw sockets when you need control over what goes on the wire, parsing hostile input without crashing, and building Burp extensions or standalone utilities that fit an existing workflow. If you are new, start with the tooling pieces — writing a small scanner teaches the protocol details faster than reading about them.