What are common Python security vulnerabilities?

Common Python security issues include unsafe deserialization with pickle, command injection through os.system() and subprocess with shell=True, Server-Side Template Injection in Jinja2, path traversal in file operations, SSRF in the requests library, and SQL injection when using string formatting instead of parameterized queries.

Why is Python popular in cybersecurity?

Python's readability, extensive standard library, and rich ecosystem of security packages make it ideal for exploit development, automation, and tool building. Libraries like pwntools, scapy, impacket, and requests are widely used in penetration testing. Python is also the primary language for Burp Suite extensions (via Jython) and many security scanners.

How do you write secure Python code?

Use parameterized queries for database access, avoid pickle for untrusted data (use JSON instead), never use eval() or exec() on user input, use subprocess with shell=False and explicit argument lists, validate and sanitize file paths to prevent traversal, and keep dependencies updated to patch known vulnerabilities.

Python Resources | appsec.fyi

Python

Python has become one of the most widely used languages in cybersecurity — from writing exploit scripts and automation tools to building security scanners and processing large datasets. Its readability, extensive standard library, and rich ecosystem of security-focused packages make it the go-to language for security professionals.

In application security, Python appears on both sides: as the language used to build web applications (Django, Flask, FastAPI) and as the primary tool for testing them. Common Python security concerns include unsafe deserialization with pickle, command injection through os.system() and subprocess, SSTI in Jinja2 templates, path traversal in file operations, and SSRF in HTTP libraries like requests.

For offensive security, Python powers many essential tools — from Burp extensions and custom fuzzers to reverse shells and exploit proof-of-concepts. Libraries like pwntools, scapy, and impacket are staples in penetration testing. For defensive security, Python is used to build SIEM integrations, log analyzers, and automated incident response workflows.

This page collects Python security resources covering both secure coding practices for Python applications and Python-based security tooling for offensive and defensive work.

python.org

Level:

Date Added	Link	Excerpt
2026-04-29 NEW 2026	LeRobot Vulnerability Enables Unauthenticated Remote Code Execution news RCE	A critical vulnerability in LeRobot allows unauthenticated remote code execution. This means attackers can exploit the flaw to run their own code on a vulnerable LeRobot system without needing any credentials. The specific details of the exploit and its impact are available via the provided link. → letsdatascience.com
2026-04-28 NEW 2026	Malicious Python package poses new supply chain threat news Supply Chain	Writeup detailing a supply chain attack on the `elementary-data` Python package, which was compromised via a GitHub Actions vulnerability. Attackers stole signing keys to publish a malicious version (0.23.3) that exfiltrated user profiles, cloud keys, API tokens, SSH keys, and .env file contents. Users are advised to rotate credentials, remove the malicious package, and check for a marker file, noting CI/CD runners are particularly at risk. → techzine.eu
2026-04-24 NEW 2026	Python Vulnerability Allows Out-of-Bounds Write on Windows Systems news	A critical vulnerability has been discovered in Python that permits out-of-bounds writes on Windows systems. This flaw could potentially lead to arbitrary code execution. While the vulnerability is significant, no specific bug bounty payout amount is mentioned in the provided content. Users of Python on Windows are advised to update to the latest version to mitigate this security risk. → cybersecuritynews.com
2026-04-24 NEW 2026	Critical Python Vulnerability Enables Out-of-Bounds Write on Windows Systems news	A critical vulnerability has been discovered in Python that allows for an out-of-bounds write on Windows systems. This means an attacker could potentially corrupt memory and gain control of a system. The vulnerability is present in the `_ssl_io_write` function within the `_ssl` module. While the article mentions the criticality of the issue, it does not state a bug bounty payout amount. → cyberpress.org
2026-04-24 NEW 2026	Python Vulnerability Enables Out-of-Bounds Write on Windows news	A vulnerability has been discovered in Python that allows for an out-of-bounds write when using the `uuid` module on Windows. This flaw could potentially lead to denial-of-service conditions or even remote code execution under specific circumstances. The vulnerability arises from how Python handles certain UUID formats on Windows. Further details and a technical breakdown are available via the provided link. The content does not specify a bug bounty payout amount. → gbhackers.com
2026-04-23 2026	wapiti-scanner/wapiti: Web vulnerability scanner written in Python3 beginner API Sec	Library for "black-box" web vulnerability scanning in Python3, acting as a fuzzer to detect issues like SQL Injections, XSS, File Disclosure, Command Execution, XXE, CRLF Injection, Shellshock, SSRF, and Log4Shell (CVE-2021-44228) by attacking scripts and forms. It supports various reporting formats, session management for resuming scans, proxy integration, authenticated scans, URL scope limitation, cookie import from browsers, and includes modules for CMS enumeration, subdomain takeover detection, and security header checks.
2026-04-22 2026	CVE-2025-68664: Critical LangChain Flaw Enables Secret Extraction news	Writeup of CVE-2025-68664, a critical serialization injection vulnerability in LangChain Core, enabling secret extraction and unintended object instantiation. The flaw, stemming from improper handling of the "lc" key during data serialization and deserialization, affects Python versions >= 1.0.0 and < 1.2.5 and < 0.3.81, and a similar issue, CVE-2025-68665, impacts LangChain.js. Exploitation involves crafting attacker-controlled LLM outputs that masquerade as trusted objects, leading to risks like secret leakage and network operations. Patched versions implement deserialization allowlists and disable environment-based secret loading by default.
2026-04-22 2026	Bandit Python: Free SAST in 10 Seconds (2026 Review) beginner	Library for static analysis of Python code, Bandit identifies common security issues through Abstract Syntax Tree analysis. It ships with 47 built-in checks targeting vulnerabilities like hardcoded credentials, weak cryptography, and injection flaws, with specialized plugins for issues such as insecure Hugging Face model downloads (B615). Bandit offers flexible configuration, multiple output formats including SARIF, baseline comparisons for incremental scans, and integrates with pre-commit hooks and Docker. It’s recommended for Python projects needing a free, focused security linter to complement broader SAST solutions. → appsecsanta.com
2026-04-22 2026	CVE-2026-22607: Fickling Python RCE Vulnerability news	Writeup of CVE-2026-22607 details an Insecure Deserialization vulnerability in Fickling, a Python pickling decompiler. Versions up to 0.1.6 incorrectly classify pickle files using `cProfile.run()` as "SUSPICIOUS" instead of "OVERTLY_MALICIOUS". This misclassification allows attackers to craft malicious pickle files, bypass Fickling's analysis, and achieve arbitrary code execution on systems relying on its security assessment for deserialization. → sentinelone.com
2026-04-22 2026	CVE-2026-21226: Azure Core Python Library RCE Vulnerability news	Library for Python applications using Azure SDKs, addressing CVE-2026-21226, an insecure deserialization vulnerability (CWE-502). Attackers with low-level authorization can execute arbitrary code over a network by crafting malicious serialized payloads processed by the vulnerable Azure Core library. Mitigation involves updating the `azure-core` package via `pip install --upgrade azure-core` and implementing input validation or network segmentation. → sentinelone.com
2026-04-22 2026	SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files news RCE	Writeup on CVE-2026-5760, a CVSS 9.8 remote code execution vulnerability in SGLang. Attackers exploit this by crafting malicious GGUF model files with Jinja2 server-side template injection payloads in the `tokenizer.chat_template` parameter. Loading these models and hitting the `/v1/rerank` endpoint allows arbitrary Python code execution on the SGLang server, similar to CVE-2024-34359 (Llama Drama) and CVE-2025-61620 in vLLM. Mitigation involves using `ImmutableSandboxedEnvironment` for rendering templates. → thehackernews.com
2026-04-22 2026	Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure news RCE	Writeup on CVE-2026-39987, a pre-authenticated RCE vulnerability in Marimo exploited within 10 hours of disclosure. The flaw, unpatched until version 0.23.0, allowed unauthenticated attackers to gain a full PTY shell by connecting to the `/terminal/ws` WebSocket endpoint without proper authentication. Attackers leveraged the exploit for credential theft, environment variable extraction, and deployment of the NKAbuse variant via Hugging Face Spaces, with CISA adding it to the KEV catalog. → thehackernews.com
2026-04-22 2026	Critical SQL Injection Vulnerability in Django (CVE-2025-64459) news	Library detailing CVE-2025-64459, a critical SQL injection vulnerability in Django that allows attackers to manipulate query logic via internal parameters like `_connector` and `_negated`. The analysis covers exploitation scenarios such as authentication bypass and data exfiltration, outlines the fix implemented in patched Django versions (5.2.8, 5.1.14, 4.2.26), and provides mitigation strategies including code review, parameter whitelisting, and testing for vulnerable patterns.
2026-04-22 2026	CERT-FR Warns of Python/CPython RCE Vulnerabilities (CVE-2026-4786, CVE-2026-6100) news	CERT-FR Warns of Python/CPython RCE Vulnerabilities (CVE-2026-4786, CVE-2026-6100)
2026-04-22 2026	Malicious PyPI Packages Deliver SilentSync RAT news	Library for Python package installers that delivers the SilentSync RAT. Malicious PyPI packages named `sisaws` and `secmeasure`, uploaded by the same author, are used to deploy SilentSync. This RAT enables remote command execution, file exfiltration, screen capturing, and web browser data theft from Chrome, Brave, Edge, and Firefox on Windows systems. The malicious packages leverage typosquatting and mimic legitimate library functionalities to evade detection.
2026-04-22 2026	Bearer: SAST Tool to Discover, Filter, and Prioritize Security and Privacy Risks beginner	Tool for static application security testing (SAST), Bearer scans source code to identify, filter, and prioritize security and privacy risks. It supports multiple languages including Go, Java, JavaScript, TypeScript, PHP, Python, and Ruby, with advanced cross-file analysis and additional languages available in its commercial version. Bearer CLI detects vulnerabilities based on OWASP Top 10 and CWE Top 25, such as Path Traversal (CWE-22), SQL Injection (CWE-89), and Cross-Site Scripting (CWE-79), and also identifies PII and PHI data flows for privacy compliance reporting.
2026-04-19 2026	PyPI Supply Chain Attack: Colorama and Colorizr Name Confusion news	PyPI Supply Chain Attack: Colorama and Colorizr Name Confusion → checkmarx.com
2026-04-19 2026	Compromised LiteLLM PyPI Package Delivers Credential Stealer news Supply Chain	Library versions 1.82.7 and 1.82.8 of the popular Python package litellm, an abstraction for interacting with LLMs from providers like OpenAI and Google, were compromised on PyPI. This malicious code acted as a multi-stage credential stealer, exfiltrating sensitive data including API keys, cloud provider credentials, and Kubernetes secrets. The payload employed AES-256-CBC encryption for data and RSA for key protection, ultimately attempting to establish persistence via a system service and download further payloads from attacker-controlled infrastructure. → sonatype.com
2026-04-19 2026	LiteLLM PyPI Package Compromised in TeamPCP Supply Chain Attack news	Library compromised in a supply-chain attack, where malicious versions of the LiteLLM Python package (1.82.7 and 1.82.8) were uploaded to PyPI by the TeamPCP hacking group. These versions deployed an infostealer that harvested sensitive data including SSH keys, cloud credentials, Kubernetes secrets, and cryptocurrency wallet data. The payload also attempted lateral movement and installed a persistent systemd backdoor, exfiltrating data to attacker-controlled infrastructure. Organizations are advised to rotate credentials and inspect systems for persistence artifacts. → bleepingcomputer.com
2026-04-19 2026	Malicious PyPI Package — LiteLLM Supply Chain Compromise news	Writeup detailing the LiteLLM supply chain compromise, where malicious Python `.pth` files in `site-packages/` automatically execute embedded, double base64-encoded payloads. These payloads exfiltrate environment variables, SSH keys, and cloud credentials to attacker-controlled servers like `models[.]litellm[.]cloud`. The attack, attributed to TeamPCP, exploits versions 1.82.8 and potentially 1.82.7 of LiteLLM, necessitating immediate credential rotation and checks for suspicious `.pth` files.
2026-04-19 2026	The PyPI Supply Chain Attacks of 2025 news Supply Chain	The PyPI Supply Chain Attacks of 2025
2026-04-16 2026	PYPI Security: How to Prevent Supply Chain Attacks in Python Projects beginner	PYPI Security: How to Prevent Supply Chain Attacks in Python Projects
2026-04-16 2026	Python Tools for Penetration Testers beginner	Library offering Python tools for penetration testers, vulnerability researchers, and reverse engineers. It lists libraries and programs for packet manipulation (Scapy, Impacket, dpkt), network reconnaissance (AutoRecon, Mitm6, SMBMap), web application security (XSStrike, Powerfuzzer, waymap), fuzzing (afl-python, Peach Fuzzing Platform), disassembly and emulation (Capstone, Unicorn Engine, Frida, Angr), memory analysis (Volatility, Rekall), and reverse engineering of applications (Androguard, Ghidatron, pefile).
2026-04-16 2026	Escalating Deserialization Attacks in Python intermediate	Library for escalating Python deserialization attacks, demonstrating how insecure deserialization with `pickle` can lead to Remote Code Execution (RCE). The entry details how to exploit Python 2 and Python 3 vulnerabilities using techniques like `__reduce__` methods, `eval`, `compile`, and `exec` to achieve code injection and access sensitive files like `/etc/passwd` without leaving obvious artifacts of direct shell access.
2026-04-16 2026	Exploiting Python Pickles - David Hamann intermediate	Writeup detailing the exploitation of Python's `pickle` module for remote code execution. It explains how the `__reduce__` method can be abused during deserialization to execute arbitrary commands, demonstrating this with a Flask application and a reverse shell payload. The writeup emphasizes the security risks of unpickling untrusted data and suggests alternatives like JSON or data signing.
2026-04-16 2026	Attack on Software Supply Chains Using Fake Python Infrastructure intermediate	Attack on Software Supply Chains Using Fake Python Infrastructure → checkmarx.com
2026-04-16 2026	Defense in Depth: A Practical Guide to Python Supply Chain Security beginner	Library for Python supply chain security, detailing defenses against attacks like the Ultralytics compromise. It advocates for layered security, starting with static analysis using Ruff, dependency pinning with cryptographic hashes via uv, and vulnerability scanning with pip-audit. The library also covers generating SBOMs with CycloneDX for rapid impact assessment, and adopting Trusted Publishing with OIDC for secure package distribution, emphasizing that no single control is perfect but multiple layers mitigate risk.
2026-04-16 2026	How Python Pickle Deserialization Security Exploit Works intermediate	Library for understanding Python pickle deserialization exploits, detailing how attackers can achieve arbitrary code execution by crafting malicious pickle payloads, often leveraging the `__reduce__` method for command injection via functions like `os.system`. The resource highlights common attack vectors such as insecure file uploads and vulnerable API endpoints that blindly deserialize untrusted data, leading to real-world impacts like remote code execution and data breaches.
2026-04-16 2026	Insecure Deserialization in Python: Attack Techniques and Secure Coding intermediate	Library for understanding and mitigating insecure deserialization vulnerabilities in Python. It details attack techniques using Python's `pickle`, `PyYAML` (specifically `yaml.load`), `jsonpickle`, `shelve`, and `marshal`. The resource covers how attackers fingerprint applications, craft payloads like reverse shells and OS command injection, and deliver them via HTTP, and includes steps for post-exploitation such as privilege escalation and lateral movement. Secure coding practices, including using `yaml.safe_load`, are also discussed.
2026-04-16 2026	The Complete Guide on Python for Cyber Security beginner	Library for integrating Python into cybersecurity workflows, aiding penetration testers, security analysts, incident responders, researchers, and network security engineers. It leverages Python's readability, extensive libraries like Requests, Scapy, Pandas, PyTorch, pwntools, Atheris, CrowdStrike FalconPy, vt-py, YARA, pySigma, and PyMISP, and its versatility to automate tasks, build exploits, analyze data, detect anomalies, and manage infrastructure, supporting tools like Nmap, Metasploit, and Burp Suite.
2026-04-13 2026	Critical flaw in Marimo Python notebook exploited within 10 hours of disclosure news	Writeup of CVE-2026-39987, a critical pre-authentication RCE vulnerability in Marimo Python notebooks, which allows unauthenticated attackers to gain a full shell and execute arbitrary commands. Exploited within 10 hours of disclosure, this flaw affects Marimo versions prior to 0.23.0 and enables credential theft in under three minutes. The vulnerability stems from an unauthenticated terminal WebSocket endpoint, highlighting risks in AI-adjacent developer tools like MLflow and Langflow. → csoonline.com
2026-04-10 2026	This Python notebook flaw shows how fast hackers are acting on advisories news	This Python notebook flaw shows how fast hackers are acting on advisories https://ift.tt/U56juBE → cybernews.com
2026-04-10 2026	Python CVE Details beginner	Python CVE Details
2026-04-10 2026	Python Security Vulnerabilities CVE Database beginner	Python Security Vulnerabilities CVE Database
2026-04-10 2026	Picklescan Allows RCE via Malicious Pickle File intermediate	Advisory GHSA-655q-fx9r-782v details a remote code execution (RCE) vulnerability in Python's pickle module. Attackers can craft malicious pickle files that bypass static analysis tools like Picklescan by leveraging `pip.main()` for installation of a compromised package. This allows arbitrary code execution during deserialization, impacting systems that process untrusted pickle data and enabling supply chain attacks.
2026-04-10 2026	CVE-2025-56005: PLY RCE Vulnerability news	Library vulnerability analysis of CVE-2025-56005 in Dabeaz PLY version 3.11, detailing an insecure deserialization flaw within an undocumented `picklefile` parameter of the `yacc()` function. This allows Remote Code Execution (RCE) through malicious pickle files, a risk amplified by the parameter's obscurity. The analysis includes technical details on the attack vector, root cause (CWE-502), detection methods, and mitigation strategies, while noting ongoing disputes regarding the CVE's validity. → sentinelone.com
2026-04-10 2026	Multi-Stage Malware Attack on Python Package Index advanced	Tool for verifying Python Package Index (PyPI) dependencies, specifically addressing the chimera-sandbox-extensions malware that harvested developer credentials and environment variables. It emphasizes implementing curated package registries, software composition analysis within CI/CD pipelines, lock file usage, and hash-based verification to prevent supply chain attacks. The tool supports techniques like static and dynamic analysis to detect credential harvesting and DGA calls, alongside runtime sandboxing and secret management to mitigate risks from compromised dependencies.
2026-04-10 2026	CVE-2025-1716 Sonatype Security Advisory news	Advisory detailing CVE-2025-1716, an unsafe deserialization vulnerability in Python's `pickle` module, allowing bypass of static analysis tools like `picklescan`. An attacker can craft a malicious model using `pickle` to execute `pip.main()` and install a compromised PyPI package, leading to remote code execution. The vulnerability, CWE-184, stems from `pip` not being treated as an unsafe global by `picklescan` before version 0.0.21. Sonatype recommends upgrading to version 0.0.22 or higher for mitigation. → sonatype.com
2026-04-10 2026	Picklescan Fails to Detect Unsafe Globals Advisory intermediate	Library advisory details a bypass of Picklescan by an unsafe deserialization vulnerability in Python's pickle module. Attackers can leverage `pip.main()` during unpickling to install a malicious package, achieving remote code execution (RCE) via the package's `setup.py` or entry points. This technique allows for silent exploitation and supply chain attacks, as the use of `pip` may not trigger typical security alerts.
2026-04-10 2026	CVE-2025-1716: Picklescan Analysis Bypass RCE news	Writeup of CVE-2025-1716, detailing an unsafe deserialization vulnerability in Python's pickle module. Attackers can bypass static analysis tools like Picklescan by exploiting `pip.main()` during deserialization, leading to the installation of malicious packages and subsequent remote code execution (RCE). The exploit leverages `pip install` to fetch and run arbitrary code from setup.py or post-install hooks, making it a potent supply chain attack vector.
2026-04-10 2026	Critical Python PLY Library Vulnerability Enables RCE news	Critical Python PLY Library Vulnerability Enables RCE → cyberpress.org
2026-04-10 2026	CVE-2025-56005: Python PLY Flaw Enables Remote Code Execution news	Library for hardening Python applications against the CVE-2025-56005 remote code execution vulnerability in the PLY (Python Lex-Yacc) library. This flaw exploits unsafe pickle deserialization when loading cached parser tables via the undocumented `picklefile` parameter, allowing arbitrary code execution during application startup before traditional security controls are active. The library addresses this by promoting secure deserialization practices, filesystem hardening for parser cache locations, and pipeline protections to prevent artifact poisoning. → esecurityplanet.com
2026-04-10 2026	CVE Search: Python beginner	CVE Search: Python
2026-04-10 2026	Python CVE Details beginner	Python CVE Details
2026-04-10 2026	Python Security Vulnerabilities & Risk Score beginner	Library providing a comprehensive security risk assessment for Python, analyzing 349 vulnerabilities with EPSS scores, exploitation status, and remediation availability. It identifies specific weaknesses like `shutil.unpack_archive()` handling of Windows absolute paths, `BaseCookie.js_output()` character neutralization, and out-of-bounds writes in `asyncio.ProacterEventLoop.sock_recvfrom_into()`. The data includes CVEs such as CVE-2026-5713 for mote debugging, CVE-2026-4786 for command injection via `webbrowser.open()`, CVE-2026-6100 for use-after-free in decompression, and CVE-2026-1502 for HTTP client proxy tunnel validation issues, alongside Pillow's vulnerability to FITS GZIP decompression bombs.
2026-04-10 2026	Python Security Vulnerabilities in 2026 beginner	Survey of Python security vulnerabilities impacting versions up to 3.15.0, detailing CVEs such as CVE-2026-6019 (XSS via Morsel.js_output), CVE-2026-3298 (OOB Buffer Write in ProactorEventLoop), and CVE-2026-5713 (Privileged Memory Access via Profiling/Asyncio Introspection). The analysis also highlights issues like command injection in webbrowser.open (CVE-2026-4786), CRLF injection in http.client, and quadratic complexity DoS vulnerabilities in xml.dom.minidom and HTMLParser. The resource also touches upon resource exhaustion in plistlib and various tarfile module vulnerabilities including filter bypass, arbitrary filesystem writes, and infinite loops.
2026-04-10 2026	RCE With Modern AI/ML Formats and Python Libraries intermediate	Library vulnerabilities in NVIDIA's NeMo, Salesforce's Uni2TS, and Apple/ETH Zurich's FlexTok allow for remote code execution (RCE) when malicious metadata is loaded. These PyTorch-based AI/ML libraries, widely used on HuggingFace, leverage Hydra's `instantiate()` function to load configurations, inadvertently executing arbitrary code embedded in metadata. CVE-2025-23304 (NeMo) and CVE-2026-22584 (Uni2TS) have been assigned, with fixes released by the respective vendors. → unit42.paloaltonetworks.com
2026-04-10 2026	Critical PickleScan Vulnerabilities Expose AI Model Supply Chains news	Writeup of CVE-2025-10155, CVE-2025-10156, and CVE-2025-10157, three critical vulnerabilities in PickleScan. These flaws enable attackers to bypass model scanning safeguards and distribute malicious AI models by exploiting file extension misclassifications, divergent ZIP archive handling between PickleScan and PyTorch, and evasion of dangerous import blacklisting through subclassing. The vulnerabilities, with a CVSS score of 9.3, underscore risks in AI supply chains and highlight the need for layered defenses and safer formats like Safetensors. → infosecurity-magazine.com
2026-04-10 2026	How a Poisoned Security Scanner Backdoored LiteLLM intermediate	Library that suffered a supply chain attack via Trivy and Checkmarx KICS, resulting in malicious versions (1.82.7 and 1.82.8) of the litellm Python package being published to PyPI. The attack involved credential harvesting through a compromised GitHub Action and the use of .pth files for persistence, enabling data exfiltration and lateral movement within Kubernetes environments. → snyk.io
2026-04-06 2026	Rapid Exploitation and Clever Malware in the Supply Chain — Last Week in AppSec news	Rapid Exploitation and Clever Malware in the Supply Chain — Last Week in AppSec → checkmarx.com

2026-04-06 2026	CrewAI contains multiple vulnerabilities including SSRF, RCE intermediate SSRF	Vulnerabilities in CrewAI include CVE-2026-2275 (RCE via Code Interpreter Tool fallback), CVE-2026-2286 (SSRF via RAG search), CVE-2026-2287 (RCE via Docker fallback), and CVE-2026-2285 (arbitrary file read via JSON loader). Attackers can chain these, exploiting prompt injection to achieve RCE, arbitrary file reads, and SSRF, potentially leading to credential theft or further system compromise. Mitigation involves restricting the Code Interpreter Tool, avoiding `allow_code_execution=True`, sanitizing input, and monitoring Docker status.
2026-04-06 2026	CVE-2026-33873: Langflow Agentic Assistant RCE Vulnerability news	Analysis of CVE-2026-33873 in Langflow details a critical code injection vulnerability (CWE-94) in the Agentic Assistant feature. Versions prior to 1.9.0 incorrectly execute LLM-generated Python code during validation, allowing attackers to achieve arbitrary server-side Python execution by manipulating AI output. This network-accessible vulnerability requires low privileges and can lead to system compromise. Mitigation involves upgrading to Langflow 1.9.0 or later, or disabling the Agentic Assistant feature. → sentinelone.com
2026-04-06 2026	CVE-2026-34519: AIOHTTP XSS Vulnerability news	Library for detecting and mitigating CVE-2026-34519, an HTTP Response Splitting vulnerability in AIOHTTP versions prior to 3.13.4. This flaw, classified as CWE-113, allows attackers to inject arbitrary HTTP headers by controlling the `reason` parameter in `Response` objects, potentially leading to cache poisoning or cross-site scripting. The library assists in identifying affected applications and provides mitigation strategies, including upgrading AIOHTTP, input sanitization for CRLF characters, and WAF rule implementation. → sentinelone.com
2026-04-05 2026	Known Unpatched Exploitable: Redashs Python Sandbox Escape Gives Attackers Full Server Access news	Writeup of a Redash sandbox escape vulnerability, exploitable via the Python data source, allowing remote code execution and full server compromise. OX Research discovered that an insecure reassignment of Python's `getattr` function within the sandbox context enables attackers to access and execute arbitrary system commands, leading to potential data exposure and lateral movement. All Redash versions with the Python data source enabled are affected, with no patch currently available. → ox.security
2026-04-03 2026	A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI advanced	A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI → arxiv.org
2026-04-03 2026	Exposing 4 Critical Vulnerabilities in Python PickleScan \| Sonatype news Deser	Writeup of four critical vulnerabilities discovered in the Python security tool picklescan. CVE-2025-1716 allows arbitrary code execution, bypassing static analysis. CVE-2025-1889 fails to detect hidden files relying on extensions. CVE-2025-1944 is vulnerable to ZIP filename tampering, causing crashes but allowing model loading. CVE-2025-1945 fails to detect malicious files when ZIP file flag bits are modified. These issues impact AI/ML model security and were addressed in picklescan version 0.0.23. → sonatype.com
2026-04-03 2026	Python SAST Tools: Free & Paid Solutions for Secure Code Analysis beginner	Library providing Static Application Security Testing (SAST) for Python, employing lexical, control flow, data flow, and semantic analysis to detect vulnerabilities. It details open-source tools like Bandit and Semgrep, and commercial solutions such as Checkmarx, Veracode, GitHub Advanced Security, and GitLab SAST. The library emphasizes IDE plugin and CI/CD integration for "Shift Left Security" practices, enabling early detection and remediation of issues like injection flaws and hard-coded secrets.
2026-04-03 2026	10 Common Security Gotchas in Python and How to Avoid Them beginner	10 Common Security Gotchas in Python and How to Avoid Them
2026-04-03 2026	Insecure Deserialization in Python \| Semgrep intermediate	Library for detecting insecure deserialization vulnerabilities in Python code, focusing on the dangers of libraries like `pickle`, `dill`, `jsonpickle`, and `shelve` when processing untrusted input. It highlights how these libraries can lead to remote code execution and provides examples of exploitation, including a demonstration with `pickle.dumps` and `os.system`. The library's rules identify data flow from untrusted sources to sensitive deserialization functions, offering practical recommendations to avoid risks such as avoiding `pickle` for untrusted data, using safer alternatives like JSON or `PyYAML`'s `safe_load`, and integrating Semgrep scans into CI pipelines. Specific mitigations for Django, NumPy, and PyTorch are also mentioned.
2026-04-03 2026	PyTorch Users at Risk: 3 Zero-Day PickleScan Vulnerabilities \| JFrog news Deser	Library for detecting vulnerabilities in PyTorch models. JFrog Security Research discovered three zero-day vulnerabilities in PickleScan, the industry-standard tool for scanning pickle-based models. These bypasses, including CVE-2025-10155, allow attackers to embed undetected malicious code within PyTorch models, leading to potential supply chain attacks. PickleScan's reliance on file extension checks over content analysis, and its blacklist approach, create these exploitable gaps.
2026-04-03 2026	PickleScan - Security Scanner Detecting Suspicious Python Pickle Files beginner	Tool for scanning Python Pickle files for malicious code execution. PickleScan detects dangerous global imports like `eval()` within pickle data, supporting analysis of local files, directories, URLs, and Hugging Face models. It offers filtering capabilities for directory scans and exit codes similar to ClamAV. The tool draws upon research from various security experts and events, including discussions on backdooring pickle files and arbitrary code execution vulnerabilities.
2026-04-03 2026	Python Secure Coding Guidelines beginner	Python Secure Coding Guidelines
2026-04-03 2026	Bandit: Python Static Application Security Testing Guide beginner	Library for static analysis of Python code, Bandit identifies security vulnerabilities like insecure cryptography (B303, B304), use of `assert` (B101), `eval`/`exec` (B102, B307), hardcoded secrets (B105), `pickle` (B301), and `subprocess` issues (B602). It integrates into development workflows and CI/CD pipelines, generating detailed reports for remediation. Complementary tools include Safety and pytest.
2026-04-03 2026	Python Security Vulnerabilities \| Top Issues \| Aikido beginner	Library for identifying and mitigating common Python security vulnerabilities. It details risks like arbitrary code execution via `eval()` and `exec()`, OS command injection through `subprocess` and `os.system`, and the dangers of hardcoded secrets. The library emphasizes practical mitigation techniques, such as avoiding unsafe function usage, using argument lists with `subprocess`, and employing secure secret management practices. It highlights how SAST tools can detect these patterns early in development. → aikido.dev
2026-03-03 2026	Show HN: Drawbridge – Drop-In SSRF Protection for Python \| Hacker News intermediate SSRF	Library for drop-in SSRF protection for Python applications, replacing `requests` or `httpx`. Drawbridge resolves DNS, validates all IPs against private/reserved ranges, pins connections by rewriting URLs to validated IPs, and re-validates on redirects. This method effectively blocks DNS rebinding, address obfuscation, and redirect-based SSRF attacks.
2026-01-17 2026	pwviptbl/ProxyHunter: Aplicação Python com interface gráfica que permite configurar regras de interceptação para modificar parâmetros de requisições HTTP. Quando o navegador envia uma requisição para uma rota configurada, o proxy intercepta, modifica apenas os parâmetros especificados e encaminha a requisição mantendo todos os outros parâmetros originais. intermediate API Sec Burp	Tool that intercepts HTTP requests to modify specific parameters. ProxyHunter is a Python application with a graphical interface that allows users to configure interception rules for HTTP requests. It intercepts requests to configured routes, modifies only specified parameters, and forwards the request while preserving all other original parameters. Features include a GUI, multiple rule configuration, GET and POST support, individual rule activation/deactivation, JSON persistence, configurable port, manual interception, WebSocket support, an advanced Intruder, and a vulnerability scanner detecting SQL Injection, XSS, CSRF, Path Traversal, and exposed sensitive information.
2026-01-12 2026	dr34mhacks/jwtauditor: JWT Auditor – Analyze, break, and understand your tokens like a pro. intermediate JWT	Library for comprehensive JWT security testing, enabling penetration testers to decode, analyze, and exploit tokens. It features automated vulnerability detection for 15+ types, including algorithm confusion attacks, KID parameter injection, and JKU/X5U manipulation. JWTAuditor also supports secret bruteforcing, token editing, and generation, with all processing handled client-side for privacy. It includes built-in wordlists and custom support, detailed explanations for findings, and guides on JWT fundamentals and attack techniques.
2025-12-24 2025	yo-yo-yo-jbo/python_for_researchers: Python for offensive security research beginner	Library for offensive security researchers demonstrating advanced Python techniques. It details how to execute Python code from C using dynamic library loading of `libpythonX.Y.so`, leveraging functions like `Py_Initialize` and `PyRun_SimpleString`. Conversely, it explores using Python's `ctypes` module for low-level Windows API interactions, such as implementing a DLL injector by calling `CreateToolhelp32Snapshot`, `OpenProcess`, `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
2025-12-03 2025	30 low-high level honeypots in a single PyPI package beginner Supply Chain	https://t.co/sH0hx43Dcp
2025-11-09 2025	Exploring HTTPS With Python beginner	Tutorial on building Python HTTPS applications, covering HTTP fundamentals, the role of TLS/SSL in securing communications, analyzing network traffic, applying cryptography, and understanding Public Key Infrastructure (PKI). It guides users through creating their own Certificate Authority and building a secure Python HTTPS server using Flask, including identifying common warnings and errors. → realpython.com
2025-10-12 2025	I Tried Automating My Entire Browser with Python — Now I Barely Click Anything intermediate	I Tried Automating My Entire Browser with Python — Now I Barely Click Anything How Selenium, Playwright, and a few tricks turned me into a lazy automation wizard 1. I Was Tired of Logging In 10 …
2025-10-12 2025	How I Built 6 Micro-Tools in Python That Earn Me Passive Income Daily beginner	How I Built 6 Micro-Tools in Python That Earn Me Passive Income Daily I stopped chasing big projects and started building tiny, high-impact Python scripts. These libraries helped me automate, scale … → python.plainenglish.io
2025-08-14 2025	Writing API exploits in Python intermediate	Library for generating Python API exploit proof-of-concepts, focusing on BOLA vulnerabilities within the crAPI project. It demonstrates converting requests captured in Burp Suite's Repeater or Intruder into executable Python code using the `curlconverter` tool. The process involves cleaning up `curl` commands, transpiling them to Python, and then refining the generated code for better usability, incorporating features like argument parsing for target URLs and report IDs. → danaepp.com
2025-08-14 2025	Python Requests Cheatsheet \| ProxiesAPI beginner	Library for crafting HTTP requests in Python, this cheatsheet covers sending GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS requests. It details handling response content as text, JSON, or binary, managing status codes, and customizing request headers with techniques like custom User-Agents and OAuth1. The resource also illustrates session management for persistent parameters, file uploads, setting timeouts, configuring proxy servers, and implementing SSL verification. Advanced sections explore error handling with `requests.exceptions`, debugging using hooks and logging, JSON serialization/deserialization, response metadata access, handling compression, and advanced pagination strategies.
2025-08-14 2025	GitHub - paulpierre/markdown-crawler: A multithreaded ?️ web crawler that r intermediate	Tool for multithreaded web crawling that converts pages into markdown files. Primarily designed for large language model document parsing, simplifying RAG and LLM fine-tuning use cases by normalizing large documents. Features include threading, resuming crawls, configurable depth, and support for tables and images. It utilizes BeautifulSoup for HTML parsing and offers a CLI interface for direct use.
2025-08-14 2025	GitHub - Fadi002/de4py: toolkit for python reverse engineering intermediate	Library for Python reverse engineering; de4py offers automatic and manual deobfuscation tools with a PySide6 UI. It supports common packers and integrates with local LLMs via Ollama for AI-assisted deobfuscation of heavily obfuscated code, utilizing models like qwen2.5-coder:1.5b. The toolkit is structured with core logic, deobfuscator engines, a user interface, and utilities, and is available under a non-commercial license.
2025-08-14 2025	How to store your users' API keys securely in Django ? intermediate	Library for securely encrypting and storing user API keys in Django applications. This solution involves generating a Fernet encryption key, storing it in environment variables, and creating a Django model to manage encrypted keys. The guide details setup, model creation, frontend development with forms and views, template integration, and final deployment steps, offering an alternative of offloading encryption to services like AWS KMS.
2025-08-14 2025	Let’s create a Python Debugger together: Part 1 \| Mostly nerdless intermediate	Library implementing a Python debugger from scratch, starting with a `breakpoint()` function-based version. This library allows users to set breakpoints, inspect local variables using `sys._getframe()`, and execute arbitrary Python code within the context of the interrupted function. It extends the built-in `pdb` functionality by providing a simplified interface for debugging Python scripts.
2025-08-14 2025	The easy way to concurrency and parallelism with Python stdlib beginner	Library utilizing Python's standard library `concurrent.futures` module, specifically `ThreadPoolExecutor` and `ProcessPoolExecutor`, for simplified concurrency and parallelism. This resource demonstrates how to effectively manage tasks like web scraping or file operations without the complexity often associated with these concepts, providing concrete examples of code implementation.
2025-08-14 2025	Pygoat - Learn Django security the hard way - Speaker Deck beginner Bug Bounty	Library for learning Django security by attacking and securing Pygoat, an intentionally vulnerable Python application. It covers OWASP Top 10 vulnerabilities like Sensitive Data Exposure (CWE-259, CWE-327, CWE-331) and Injection flaws (SQL, NoSQL, OS command, ORM, LDAP, EL/OGNL), offering mitigation strategies such as proper access control, input validation, parameterized queries, and disabling debug modes. The resource also emphasizes secure design patterns, threat modeling, and maintaining up-to-date software components.
2025-08-14 2025	Click and Python: Build Extensible and Composable CLI Apps – Real Python beginner	Library for building extensible and composable Python command-line interfaces. It offers a more flexible and intuitive alternative to `argparse`, leveraging decorators to easily add arguments, options, and subcommands. Click handles type-aware input processing and automatically generates usage and help pages, streamlining CLI development. → realpython.com
2025-08-14 2025	Asyncio, twisted, tornado, gevent walk into a bar... beginner	Library for asynchronous I/O in Python, featuring frameworks like asyncio, twisted, tornado, and gevent. These tools manage concurrent network operations efficiently by allowing other program parts to execute while waiting for external responses, significantly speeding up tasks such as web crawling or server operations. The library demonstrates this with an example fetching titles from multiple URLs, showing dramatic performance improvements over synchronous methods.
2025-08-14 2025	How to Launch an HTTP Server in One Line of Python Code – Real Python beginner	Library for launching a basic HTTP server with a single Python command. Utilize the `http.server` module to serve static files from any directory, specifying ports like 8000 or 8080, and binding to specific interfaces with the `-b` option. Restrict access by binding to `127.0.0.42` or use administrative privileges with `sudo` to serve on port 80. The `-d` option allows serving content from an alternative directory, bypassing potential import conflicts. → realpython.com
2025-08-14 2025	https://www.codelivly.com/building-a-vulnerability-scanner-using-python/ intermediate	Library for building a vulnerability scanner in Python, this resource details a process that begins with converting a port scanner into a class. The script then prompts for target IP, port range, and a file listing known vulnerable software banners. It scans for open ports, retrieves service banners, and compares them against the provided vulnerability list to identify and report exploitable services.
2025-08-14 2025	Build an Arp Spoofer From Scratch \| by Rahul Kumar \| Jan, 2023 \| System Wea intermediate	The content appears to be about creating an ARP spoofer from scratch, authored by Rahul Kumar in January 2023. ARP spoofing is a technique used for network manipulation by sending false Address Resolution Protocol (ARP) messages. The article likely provides instructions or insights on how to build this tool independently.
2025-08-14 2025	Creating an Advanced Network Packet Sniffer in Python: A Step-by-Step Guide intermediate	The content is a guide on building an advanced network packet sniffer using Python. It likely provides a detailed, step-by-step approach to creating a tool that can intercept and log network traffic for analysis or monitoring purposes. The guide may cover topics such as capturing packets, analyzing their contents, and potentially implementing additional features to enhance the functionality of the packet sniffer. Overall, it aims to help readers understand the process of developing a network packet sniffer using Python.
2025-08-14 2025	Python Simple HTTP Server With SSL Certificate (Encrypted Traffic) \| Python intermediate	The content appears to be about setting up a Python Simple HTTP Server with an SSL certificate to enable encrypted traffic. This setup allows for secure communication over the network by encrypting data exchanged between the server and clients. The use of SSL certificates ensures that the data transmitted is protected from unauthorized access or interception. This setup is beneficial for enhancing the security of web applications or services that require secure communication protocols. → python.plainenglish.io
2025-08-14 2025	Python Decorators (made easy). Decorator can be used to send function… \| by beginner	The content seems to be about Python decorators, which are used to modify or extend the behavior of functions in Python. Decorators are a powerful tool that can be used to add functionality to existing functions without modifying their code. They are commonly used for tasks like logging, authentication, and performance monitoring. Decorators are a key feature in Python that allows for cleaner and more modular code.
2025-08-14 2025	Python Requests Library Caused a Production Outage \| by Daryan Hanshew \| Ju news	The Python Requests library caused a production outage, as reported by Daryan Hanshew. The incident likely involved issues or errors related to the use of the Python Requests library, impacting the production environment. Further details or insights about the outage, its causes, and potential solutions are not provided in the summary.
2025-08-14 2025	https://github.com/microsoft/picologging beginner	Library for high-performance Python logging, picologging offers a drop-in replacement for the standard library's `logging` module, boasting 4-17x speed improvements. It maintains API compatibility, allowing seamless integration into existing applications. Installation is available via pip or conda, and developers can utilize its CPython 3.11 components for enhanced compatibility and debugging capabilities.
2025-08-14 2025	TryHackMe \| Python Basics. In this story I will be sharing my… \| by Mukkara beginner	The content appears to be about a story shared by Mukkara on TryHackMe regarding Python basics. The story likely includes insights, experiences, or tutorials related to Python programming fundamentals. Mukkara may be sharing tips, tricks, or lessons learned while exploring Python basics on the TryHackMe platform. The content seems to focus on practical applications or explanations of Python concepts for beginners or those interested in learning more about Python programming.
2025-08-14 2025	6 Python Libraries For Cyber Security Professionals and Ethical Hackers \| b beginner	The content mentions 6 Python libraries useful for cyber security professionals and ethical hackers. These libraries likely provide tools and functions that can assist in tasks related to cybersecurity, such as threat detection, vulnerability analysis, or penetration testing. Python is a popular programming language in the cybersecurity field due to its versatility and ease of use for developing security tools and scripts. The libraries mentioned may offer pre-built functionalities that can streamline and enhance the work of professionals in the cybersecurity and ethical hacking domains. → python.plainenglish.io
2025-08-14 2025	RegEx in Python: Introduction and The use of Backslash \| by Manash Bhele \| beginner	The content titled "RegEx in Python: Introduction and The use of Backslash" by Manash Bhele likely discusses regular expressions (RegEx) in Python, introducing the concept and focusing on the use of the backslash (\) character within regular expressions. The article may delve into how backslashes are utilized in Python's RegEx to escape special characters or create specific patterns for matching text. It is a beginner-friendly guide that aims to explain the basics of using RegEx in Python with a particular emphasis on understanding and applying the backslash in regular expressions.
2025-08-14 2025	https://www.thepythoncode.com/article/create-reverse-shell-python intermediate	Library for creating reverse shells in Python. This resource details the implementation of both server (attacker) and client (target) code, enabling remote execution of system commands like `cmd.exe` or `bash/zsh` and bypassing firewalls by initiating connections from the target to the attacker. It covers socket programming, command execution via `subprocess`, directory traversal with `os.chdir`, and message passing with a custom separator.
2025-08-14 2025	(304) Remote Procedural Call via XML-RPC in 5 minutes - YouTube beginner	The content is a video tutorial on YouTube titled "(304) Remote Procedural Call via XML-RPC in 5 minutes." It likely provides a quick guide or demonstration on how to perform remote procedural calls using XML-RPC within a short timeframe. The video may offer step-by-step instructions or examples to help viewers understand and implement XML-RPC for remote communication.
2025-08-14 2025	A Python prompt into a running process: debugging with Manhole intermediate	Library for live debugging of running Python processes. Manhole enables an interactive Python prompt attached to a live process, allowing inspection of variables and state. It uses Unix domain sockets and can be accessed via tools like `socat`. While useful for diagnosing unexpected behavior, its use in production carries risks of unintended modifications and highlights a need for robust logging and monitoring. The library supports exposing specific objects or using the garbage collector to access program state.
2025-08-14 2025	Python monkey-patching like a boss \| by Sergei \| Medium intermediate	The content appears to be about monkey-patching in Python, a technique that allows developers to dynamically modify or extend the behavior of classes or modules at runtime. Monkey-patching can be a powerful tool when used carefully, but it can also lead to unexpected behavior and should be approached with caution. The article likely discusses best practices, examples, and considerations for effectively implementing monkey-patching in Python.
2025-08-14 2025	https://github.com/pikepdf/pikepdf beginner	Library for reading, writing, repairing, and transforming PDFs in Python. Built on the qpdf C++ library, pikepdf offers automatic PDF repair, XMP metadata editing, robust encryption support (AES-256, AES-128, RC4), and linearization for fast web viewing. It provides a Pythonic API for low-level manipulation and object access, along with lossless image extraction and Jupyter integration. Binary wheels are available for all major platforms, simplifying installation.
2025-05-24 2025	Django Security Best Practices: A Comprehensive Guide for Software Engineers - Corgea - Home beginner	Library for hardening Django applications, detailing best practices against threats like XSS, SQL injection, and CSRF. It covers updating Django versions, enabling HTTPS with `SECURE_SSL_REDIRECT`, using strong `SECRET_KEY` management, securing databases, and leveraging Django's built-in features like `SecurityMiddleware`, Content Security Policy via `django-csp`, and `X_FRAME_OPTIONS`. The resource also addresses authentication hardening with `AUTH_PASSWORD_VALIDATORS` and packages like `django-otp`, dependency auditing using `pip-audit`, and comprehensive logging.
2025-05-07 2025	Using JWTs in Python Flask REST Framework \| AppSignal Blog intermediate API Sec AuthN	Library implementing JSON Web Tokens (JWTs) for secure authentication in Python Flask REST frameworks. It details JWT structure (header, payload, signature), benefits like stateless sessions and efficiency, and provides practical examples for user registration, login, token creation using `Flask-JWT-Extended`, and securing API endpoints with `@jwt_required()`. The entry also covers implementing refresh tokens for longer sessions and managing token expiration.
2025-03-01 2025	GitHub - roshanlam/Spider: Web Crawler built using asynchronous Python and distributed task management that extracts and saves web data for analysis. beginner	Library for asynchronous, distributed web crawling and data extraction. It leverages aiohttp, asyncio, Celery, Redis, and PostgreSQL to manage tasks, store data, and process information. Features include a plugin architecture for custom logic, comprehensive webpage data extraction (metadata, content, links, forms, social metadata), NLP-based entity recognition with spaCy, and JavaScript rendering support via Playwright. The library allows for scalable crawling, real-time metrics, and robust logging.
2025-01-14 2025	Build Your Web Scraper with Crawlbase in Python: A Beginner’s Guide beginner	Learn how to build your first web scraper in Python using Crawlbase. This beginner-friendly guide covers web scraping essentials, bypassing
2024-12-31 2024	GitHub - danialhalo/SqliSniper: Advanced Time-based Blind SQL Injection fuzzer for HTTP Headers advanced Fuzzing SQLi	Tool for advanced time-based blind SQL injection fuzzing in HTTP headers. SqliSniper utilizes multi-threaded scanning for efficiency and employs response time analysis to reduce false positives. It supports custom payloads and headers, and can send alerts to Discord webhooks upon detecting vulnerabilities. The tool can scan single URLs, lists of URLs from a file, or process piped input from other security tools.
2024-12-29 2024	Python for Dark Web OSINT: Automate Threat Monitoring intermediate OSINT	Learn how to use Python to automate monitoring of dark web forums, leak sites, and marketplaces for actionable threat intelligence.
2024-12-20 2024	GitHub - xnl-h4ck3r/knoxnl: This is a python wrapper around the amazing KNOXSS API by Brute Logic intermediate API Sec	Library for interacting with the KNOXSS API, enabling automated scanning for XSS and Open Redirect vulnerabilities. This Python wrapper supports various input methods, including single URLs and files, and allows for custom configurations for API keys, Discord webhooks, and output formats. It integrates with Burp Suite via the Piper extension, facilitating in-proxy security testing. The library respects KNOXSS API rate limits and offers features like Flash Mode for quick polyglot tests and handling of POST requests.
2024-12-19 2024	GitHub - WafflesExploits/hide-payload-in-images: A project that demonstrates embedding shellcode payloads into image files (like PNGs) using Python and extracting them using C/C++. Payloads can be retrieved directly from the file on disk or from the image stored in a binary's resources section (.rsrc) advanced RCE	Library for embedding and extracting shellcode payloads within image files like PNGs. Utilizes Python for embedding and C/C++ for extraction, supporting retrieval from disk or a binary's `.rsrc` section. Includes stealthy extraction via manual PE header parsing and PEB access, avoiding WinAPI calls for enhanced evasion. Supports both executable and DLL builds with improved PEB structure definitions for portability.
2024-12-12 2024	GitHub - mherrmann/helium: Lighter web automation with Python beginner	Library for lighter web automation in Python, Helium offers a high-level API that simplifies tasks compared to Selenium. It allows referencing elements by user-visible labels, resulting in shorter and more stable scripts. Helium also streamlines interaction with iframes, window management, and provides built-in implicit and explicit waits, eliminating the need for complex `WebDriverWait` calls. The library is sponsored by RapidProxy and can be installed via pip.
2024-12-11 2024	GitHub - apify/crawlee-python: Crawlee—A web scraping and browser automation library for Python to build reliable crawlers. Extract data for AI, LLMs, RAG, or GPTs. Download HTML, PDF, JPG, PNG, and other files from websites. Works with BeautifulSoup, Playwright, and raw HTTP. Both headful and headless mode. With proxy rotation. beginner	Library for building reliable web scrapers and crawlers in Python. It offers a unified interface for both HTTP and headless browser crawling, supporting BeautifulSoupCrawler for HTML parsing and PlaywrightCrawler for JavaScript-heavy sites. Key features include automatic retries, proxy rotation, configurable request routing, persistent queues, and pluggable storage for extracted data and files. Crawlee leverages asyncio for performance and integrates seamlessly with other asynchronous Python libraries.
2024-11-29 2024	Python Twisted proxy - how to intercept packets intermediate Burp	Library for intercepting and modifying HTTP request and response bodies using Python's Twisted framework. Demonstrates a basic proxy setup using `twisted.web.proxy` and `twisted.internet.reactor`, enabling developers to inspect and alter data as it flows through the proxy. The provided code snippet serves as a starting point for building custom HTTP proxy functionalities. → stackoverflow.com
2024-10-30 2024	Flask & Pydantic: Streamline Python APIs with Seamless Data Validation intermediate	This guide explores the seamless integration of Flask, a popular web framework, with Pydantic, a powerful data validation library.
2024-10-30 2024	SSH Scripting with Fabric and Python - Mouse Vs Python beginner	Library for executing shell commands remotely over SSH using Python. This resource demonstrates using Fabric 3.2.2 to connect to servers, run commands with or without `sudo`, and transfer files using `put()` and `get()` methods, including uploading to restricted directories via a two-step `put()` and `sudo()` process.
2024-10-24 2024	Cryptography — The Hitchhiker's Guide to Python beginner Secrets	Library for Python cryptography, offering both high-level symmetric encryption with Fernet and low-level primitives via the `cryptography` package. It also provides GPGME Python bindings, enabling interaction with the GNU Privacy Guard suite for encryption, decryption, and signing operations, supporting Python 2.6+ and 3.3+.
2024-10-17 2024	GitHub - cle-b/httpdbg: A tool for Python developers to easily debug the HTTP(S) client requests in a Python program. intermediate	Tool for Python developers to debug HTTP(S) client and server requests. Executing programs via `pyhttpdbg` instead of `python` enables inspection of requests in a web browser at `http://localhost:4909`. Supports HTTP/1.0, HTTP/1.1, and HTTP/2. It can trace requests made by scripts, modules (like `pip`), and tests (`pytest`, `unittest`), and can record requests received by HTTP servers. The tool allows grouping requests by test and offers customization options for the web interface.
2024-10-01 2024	GitHub - bl4de/security-tools: My collection of various security tools created mostly in Python and Bash. For CTFs and Bug Bounty. intermediate Bug Bounty	My collection of various security tools created mostly in Python and Bash. For CTFs and Bug Bounty. - bl4de/security-tools
2024-09-23 2024	Let’s build and optimize a Rust extension for Python intermediate	Library for optimizing Python performance by building Rust extensions. This resource details how to create a Rust extension for Python using tools like PyO3 and Maturin. It contrasts a memory-intensive exact unique value count with a probabilistic approach, then demonstrates reimplementing the probabilistic algorithm in Rust to achieve significant speed improvements over the pure Python version, showcasing techniques for efficient data handling and integration with Python objects.
2024-09-16 2024	PyCript: Burp Suite extension that allows for bypassing client-side encryption intermediate Burp	Library for bypassing client-side encryption in Burp Suite, PyCript facilitates penetration testing by enabling dynamic encryption and decryption of requests. It supports custom JavaScript and Node.js logic for flexible encryption/decryption processes, integrates with Burp Scanner, SQLMap, and Intruder for automated testing, and handles keys and IVs embedded within request headers or bodies.
2024-08-28 2024	GitHub - mkalioby/django-mfa2: A Django app that handles MFA, it supports TOTP, U2F, FIDO2 U2F (Webauthn), Email Token and Trusted Devices intermediate AuthN	Library providing multi-factor authentication (MFA) for Django applications. It supports TOTP, U2F, FIDO2 (WebAuthn) with various authenticators like security keys and Windows Hello, Email Tokens, and Trusted Devices. The library allows for customizable settings, integration with existing login flows, and offers passwordless login capabilities.
2024-08-21 2024	17 Mindblowing Python Automation Scripts I Use Everyday beginner	Scripts That Increased My Productivity and Performance
2024-08-17 2024	GitHub - wapiti-scanner/wapiti: Web vulnerability scanner written in Python3 intermediate	Library for "black-box" web vulnerability scanning, Wapiti leverages Python 3.12-3.14 to act as a fuzzer, discovering vulnerabilities by sending payloads to web applications and analyzing responses. It supports various attack modules, including SQL Injections, XSS, File Disclosure, Command Execution, XXE, Shellshock, and Log4Shell (CVE-2021-44228), Spring4Shell (CVE-2020-5398), and can generate reports in multiple formats. Wapiti offers features like scan suspension, session management, proxy support, and the ability to import cookies from browsers.
2024-08-02 2024	GitHub - SpaceWolfWasTaken/httpy: A barebones HTTP server created from raw python sockets. intermediate	A barebones HTTP server created from raw python sockets. - SpaceWolfWasTaken/httpy
2024-07-26 2024	Release v0.3.0 · joaovitoriasilva/endurain news AuthN	Library release v0.3.0 for endurain, a Python application security library, introduces OAuth scopes, multi-client support (web and mobile), PWA support, theme and language switchers, and dependency management with poetry. This update also includes significant backend changes to password hashing, requiring automatic migration for admin accounts. Frontend improvements focus on UI fixes and pagination, while general updates include multi-arch Docker images and documentation enhancements. Users should back up their database before updating due to schema changes.
2024-07-23 2024	Isolating risk in the CPython release process advanced	Analysis of CPython's release process improvements, funded by Alpha-Omega, detailing the isolation of source artifact builds using GitHub Actions. This change significantly reduces the dependency footprint for critical build stages, decreasing supply chain risk by separating source artifact generation from documentation builds and testing, with the "Build Source" task now requiring approximately 170 dependencies instead of over 800.
2023-12-18 2023	Python Asyncio and Footguns intermediate	The content discusses the potential dangers of using Python's Asyncio module, referred to as "footguns," which are pitfalls that can lead to unintended consequences in asynchronous programming. It emphasizes the importance of understanding Asyncio's complexities to avoid common mistakes that can impact performance and reliability. The article likely provides insights on best practices, common pitfalls, and tips for effectively utilizing Asyncio in Python programming to maximize its benefits while minimizing risks.
2023-12-11 2023	The Complete HTTPBin CheatSheet in Python intermediate	Reference showcasing httpbin's utility for testing HTTP client code, API prototyping, and debugging common web scraping scenarios. It details how to leverage endpoints like `/get`, `/post`, `/ip`, and `/status` for validating requests, headers, proxies, and response codes, crucial for ensuring robust application and scraper functionality.
2023-12-10 2023	timo-reymann/python-oauth2-cli-auth intermediate	Library for simplifying OAuth2 authentication in Python CLIs, supporting OIDC providers like gitlab.com and manual configuration. It offers a straightforward method for obtaining access tokens without external dependencies, facilitating integrations with services requiring OAuth2 authorization. The project encourages community contributions for bug reporting, feature proposals, and code fixes.
2023-11-09 2023	How to Download Files From URLs With Python beginner	Tutorial on downloading files from URLs using Python, covering the built-in `urllib` module and the popular `requests` library. It demonstrates using `urlretrieve()` for simple downloads and `requests.get()` for more advanced interactions. The guide also touches on efficient handling of large files through streaming, parallel downloads with `ThreadPoolExecutor` and `aiohttp`, and extracting metadata from HTTP headers for downloaded content, like the `Content-Type` and `Content-Length` of a World Bank CSV file. → realpython.com
2023-11-07 2023	Using the bpython Enhanced REPL beginner	Library for enhancing the Python Read-Evaluate-Print Loop (REPL). This course teaches installation and usage of bpython, a more programmer-friendly alternative to the standard Python REPL. It covers boosting productivity with bpython's features, configuring color themes, using keyboard shortcuts, and contributing to the open-source project on GitHub. Familiarity with Python basics and the standard REPL is recommended. → realpython.com
2023-11-07 2023	4 Python Web Scraping Libraries To Mine News Data beginner	Library for mining news data, this resource details four open-source Python web scraping tools: PyGoogleNews, NewsCatcher, Feedparser, and Newspaper3k. These libraries enable developers to extract headlines, article content, authors, dates, and summaries from various news sources without requiring API keys, making them suitable for NLP projects and MVPs.
2023-11-07 2023	Peticali/FastHttpPy intermediate	Library implementing Golang's FastHttp in Python, achieving 63k requests/second, significantly outperforming Uvicorn. Easily installable via `pip install fasthttppy`, it supports static file serving, custom GET/POST request callbacks, and error/404 page configuration. Further performance gains are possible by replacing JSON communication with direct struct handling.
2023-10-29 2023	fortra/impacket intermediate	Library of Python classes for low-level network protocol interaction, including Ethernet, IP, TCP, UDP, SMB1-3, MSRPC, TDS, and LDAP. Impacket supports Plain, NTLM, and Kerberos authentication and offers tools for security researchers to facilitate network protocol research and educational activities.
2023-09-20 2023	Episode 99: OAuth 2 and Authentication Choices for Your Python Project beginner AuthN	Talk on OAuth 2 and authentication choices for Python projects. Features Dan Moore from FusionAuth discussing system setup, device grants, social login, and privacy. Includes a spotlight on a course for implementing Google Login with Flask, covering OAuth 2, OpenID Connect, and session management. Mentions RFC 6749 and RFC 6750 as key resources. → realpython.com
2023-09-20 2023	How to Authenticate using Keys BasicAuth OAuth2 inPython beginner AuthN	Library for authenticating Python applications, focusing on BasicAuth and OAuth2 using keys. It details how to implement these authentication methods for secure API interactions, covering setup and usage within Python projects. The library aims to simplify the process of integrating secure authentication into applications, ensuring data protection and access control.
2023-09-19 2023	dnspython intermediate	Library providing Python implementations for DNS record manipulation, including retrieving MX targets, performing dynamic DNS updates with TSIG keys, and manipulating domain names. It facilitates generating reverse mapping information for A RRs from zone files, converting IPv4 and IPv6 addresses to/from their DNS reverse map names, and converting E.164 numbers to/from ENUM names.
2023-09-10 2023	Python for Hackers Course \| Bug Bounty & Ethical Hacking beginner Bug Bounty	Python for Hackers Course \| Bug Bounty & Ethical Hacking https://ift.tt/X9UbTzy
2023-09-02 2023	Containerized PDF Summarizer with FastAPI and Hamilton intermediate	Library for building containerized LLM applications, showcasing a PDF summarizer using FastAPI, Streamlit, and Hamilton. This approach emphasizes modularity and dataflow principles for easier iteration, testing, and maintenance of LLM capabilities, decoupling core logic from platform concerns like API caching and scaling.
2023-09-02 2023	trafilatura: Web scraping tool for text discovery and retrieval beginner	Library for web scraping and text extraction. Trafilatura is a Python package and command-line tool that simplifies gathering text from raw HTML, offering robust discovery and processing components for web crawling, downloads, and extraction of main texts, metadata, and comments. It balances precision and recall, outperforming other open-source libraries in benchmarks, and is used by HuggingFace, IBM, and Microsoft Research. Output formats include TXT, Markdown, CSV, JSON, HTML, XML, and XML-TEI.
2023-09-02 2023	Running Untrusted Python Code intermediate	Library for securely running untrusted Python code by employing a separate process with applied resource limits. It leverages Linux's seccomp to restrict system calls, allowing only essential operations like `read` and `write` to stdout/stderr, while returning `EPERM` for unauthorized calls. Additionally, it utilizes `setrlimit` to control CPU time, virtual memory, and file size, preventing resource exhaustion. The library aims to avoid common pitfalls of in-application sandboxing, acknowledging the complexity and potential for escape vectors inherent in Python's introspection features.
2023-08-24 2023	The subprocess Module: Wrapping Programs With Python beginner	Library for running shell commands and managing external processes in Python. It enables executing commands like `ls` or `dir`, launching applications, and handling input/output streams. The library offers tools for error handling and inter-process communication, making it a flexible option for integrating command-line operations into Python projects. Key functions include `subprocess.run()`, `subprocess.call()`, and `subprocess.Popen()`, differentiating execution methods and output handling. → realpython.com
2023-08-24 2023	dis Disassembler for Python bytecode Python 3.9.6 documentation beginner	Library for analyzing CPython bytecode, the `dis` module enables inspection of compiled Python code. It disassembles functions, methods, and code objects, revealing instructions and their arguments. Key features include support for showing inline caches, specialized bytecode with `show_caches` and `adaptive` parameters, and instruction offsets with `show_offsets`. The `dis.Bytecode` class provides an object-oriented interface for iterating through instructions, and command-line invocation is supported via `python -m dis`.
2023-08-13 2023	Swing in Python Burp Extensions - Part 1 intermediate Burp	Library for crafting Python Burp extensions with custom GUIs using Jython Swing. This guide details implementing tabs, `JPanel` containers with `BorderLayout`, `JButton` actions, `JSplitPane` for layout, `JScrollPane` and `JList` for displaying data, and handling `ListSelectionEvent` with `valueChanged` to prevent double-adding events. It also covers using `JTabbedPane` for multiple tabs and `JTextPane` with `StyledDocument` for styled text, as well as `JEditorPane` for displaying web content, enabling or disabling editing.
2023-08-05 2023	Socket Programming in Python Part 1: Handling Connections beginner	Socket Programming in Python Part 1: Handling Connections https://ift.tt/2Q3W4zm → realpython.com
2023-08-05 2023	How To Keep A Secret in Python Apps beginner Secrets	Library for securely managing secrets in Python applications, emphasizing practices like avoiding hard-coding credentials, using password managers (like PinPal), and employing threat modeling. It highlights the `keyring` library for OS-native secure storage, contrasts macOS Keychain security prompts with environment variable risks, and discusses using GitHub Actions secrets. Foundational security, including disk encryption and keeping OS updated, is also stressed, alongside creating repeatable security processes and recognizing phishing red flags.
2023-06-08 2023	Test website for SQL injection vulnerabilities using Python intermediate SQLi	Test website for SQL injection vulnerabilities using Python https://ift.tt/msKlYeM
2023-06-06 2023	Reversing Pickles with r2pickledec intermediate Deser	Tool for decompiling Python pickle files, r2pickledec supports all instructions up to protocol 5. It integrates with Radare2, enabling analysis of pickle contents, including identifying serialized objects like "requests.sessions" and "Session," and understanding the assembly language used in pickles. The tool facilitates reversing complex pickle data by translating the byte stream into human-readable instructions and object structures. → blog.doyensec.com
2023-04-13 2023	Understanding Python Bytecode beginner	Understanding Python Bytecode https://ift.tt/1NED8CP
2023-04-10 2023	How to Implement OAuth 2.0 Login for Python Flask Web Server Applications intermediate API Sec AuthN	Tutorial on implementing OAuth 2.0 login for Python Flask web server applications. This guide details enabling Google APIs, creating OAuth client IDs, securely storing credentials, and writing Python code using Flask to handle user authentication and consent. It covers setting up a `requirements.txt` file, environment variables, and Jinja2 templates for a seamless Google single sign-on experience, with runnable code available on GitHub.
2023-04-03 2023	Download and Installation Scapy 2.4.5. documentation beginner Fuzzing	Library for packet manipulation and network scanning, Scapy offers installation instructions for various platforms including Unix-like systems, macOS, OpenBSD, Solaris, and Windows. It details methods for installing both the latest stable release and development versions using pip, and outlines optional dependencies for advanced features such as plotting with Matplotlib, 2D graphics with PyX, graph generation requiring Graphviz and ImageMagick, 3D graphics with VPython-Jupyter, WEP decryption and TLS decryption utilizing cryptography, Nmap fingerprinting, and VOIP functionality with SoX. Platform-specific notes cover libpcap integration, native Linux support, and Npcap requirements on Windows. Documentation can be built locally using Sphinx, and UML diagrams can be generated with pyreverse.
2023-04-03 2023	Scapy beginner Fuzzing	Scapy http://scapy.net/
2023-04-03 2023	Top 5 scapy Code Examples intermediate Fuzzing	Top 5 scapy Code Examples https://ift.tt/PJT08ay → snyk.io
2023-04-03 2023	Usage Scapy 2.4.5. documentation beginner Fuzzing	Library for network packet manipulation, Scapy enables users to craft, send, sniff, dissect, and analyze network traffic. Its interactive shell allows for dynamic packet building, layer stacking with operators like `/`, and dissection of raw data. Scapy supports reading and writing PCAP files, graphical packet dumps via PyX, and generating sets of packets using Cartesian products of field values. It provides functions like `send()` and `sendp()` for layer 3 and layer 2 packet transmission, respectively, with options for return packets, looping, and interval control. Advanced features include multicast support with scope identifiers and a `fuzz()` function for randomizing packet fields.
2023-04-03 2023	Basic and Low-level Python Network Attacks intermediate RCE	https://ift.tt/SxGhvBQ
2023-04-02 2023	Writing a Network Scanner using Python intermediate Recon	Writing a Network Scanner using Python https://ift.tt/DAWbHwz
2023-01-31 2023	Build an Arp Spoofer From Scratch intermediate	The content discusses creating an ARP spoofer from scratch. ARP spoofing involves manipulating network traffic by sending false ARP messages. By building an ARP spoofer, one can intercept and modify data packets within a network. This technique is commonly used for malicious purposes like eavesdropping or conducting Man-in-the-Middle attacks. The content likely provides a guide or instructions on how to create an ARP spoofer independently.
2023-01-31 2023	Creating an Advanced Network Packet Sniffer in Python: A Step-by-Step Guide intermediate	The content is a step-by-step guide on creating an advanced network packet sniffer using Python. It provides detailed instructions on how to build the sniffer tool, which can capture and analyze network packets for various purposes. The guide likely covers topics such as setting up the necessary libraries, capturing packets, analyzing packet data, and potentially implementing additional features for advanced functionality. Overall, the content aims to help readers understand the process of creating a network packet sniffer using Python through a structured and informative guide.
2022-10-19 2022	Python Simple HTTP Server With SSL Certificate (Encrypted Traffic) intermediate	The content discusses setting up a Python Simple HTTP Server with an SSL certificate to enable encrypted traffic. This configuration enhances security by encrypting data transmitted over the network. The SSL certificate ensures secure communication between the server and clients, protecting sensitive information from potential eavesdropping or tampering. By implementing SSL encryption, the Python Simple HTTP Server can provide a more secure environment for data exchange.
2022-09-18 2022	Python Cybersecurity beginner	The content titled "Python Cybersecurity" likely discusses the intersection of Python programming language and cybersecurity. Python is commonly used in cybersecurity for tasks like scripting, automation, and developing security tools. It is a versatile language known for its simplicity and readability, making it a popular choice among cybersecurity professionals. By leveraging Python's libraries and frameworks, cybersecurity experts can efficiently analyze data, detect vulnerabilities, and enhance security measures. The link provided likely leads to more detailed information on how Python is utilized in the field of cybersecurity.
2022-09-13 2022	OWASP Pygoat beginner	Library for developers and testers to learn secure coding and application testing. Written in Python with the Django web framework, Pygoat incorporates OWASP Top 10, Mitre CVE, and SANS 25 Top Errors vulnerabilities like XSS and SQLi. It provides source code alongside vulnerabilities, enabling users to identify and fix insecure coding practices. → owasp.org
2022-09-13 2022	OWASP Pygoat \| OWASP Foundation beginner	Library for learning application security, Pygoat is a Python-based platform built on the Django framework. It includes traditional web application vulnerabilities like XSS and SQLi, and allows users to view source code to understand and fix security flaws. Vulnerabilities can be mapped to OWASP Top Ten, MITRE CVE, and SANS Top 25 errors, providing a practical resource for developers and testers to enhance secure coding and testing practices. → owasp.org
2022-08-17 2022	10 Killer Automation Scripts For Your Daily Stuff \| by Haider Imtiaz \| Aug, intermediate	The content provides a list of ten Python scripts designed to automate daily tasks and streamline work processes. These scripts aim to simplify common problems and routines by leveraging automation. By utilizing these scripts, individuals can save time and effort on repetitive tasks, enhancing productivity and efficiency in their daily activities. → python.plainenglish.io
2022-08-17 2022	Fake webcam for your online meetings, with Python \| by Francois Le Roux \| C intermediate	The content discusses using Python to create a fake webcam for online meetings when you prefer not to show your real webcam feed. It highlights the scenario of wanting privacy during virtual meetings. The article likely delves into the technical aspects of how to achieve this using Python programming.
2022-08-15 2022	A Guide to Python Libraries For Pentesters, Ethical Hackers and System Admi beginner	Python is essential for cybersecurity professionals like penetration testers. It is a versatile tool for various tasks due to its wide range of libraries. These libraries are crucial for tasks such as data manipulation, network scanning, and exploit development. Python's flexibility and extensive library support make it a preferred choice for ethical hackers, system administrators, and cybersecurity experts.
2022-08-11 2022	The Impossible Web Scraping. Scraping a dynamic website with… \| by Nyv Mond intermediate	The content discusses the challenges of scraping dynamic websites using Python libraries like Selenium and BeautifulSoup. These tools help navigate and extract data from websites that require interaction or have changing content. Selenium is used for automating web browsers to interact with dynamic elements, while BeautifulSoup parses the extracted HTML content. By combining these tools, users can scrape data from websites that are difficult to access with traditional scraping methods.
2022-08-10 2022	How to Protect Text Input from XML External Entity (XXE) Attacks using Pyth intermediate XXE	The content discusses the importance of protecting text input from XML External Entity (XXE) attacks using Python. XXE attacks aim to disrupt an application's handling of serialized data. Implementing countermeasures in Python can help prevent these attacks and safeguard the application from potential vulnerabilities.
2022-05-05 2022	Favorite tweet by @_zwink intermediate Recon	Favorite tweet: Just created a Python script which given a list of /24 IP address ranges, will crawl them, extract domains and subdomains from SSL certs, check the domains, and write out a CSV file o...
2022-04-25 2022	Favorite tweet by @JasonFord beginner OSINT Recon	Favorite tweet: I'm continuing to work on my python skills to gather data using threat intel APIs. I've shared this script on GitHub that you can use (with your own API key) to query @EmergingThreats...
2022-03-27 2022	Python Useful Regex Quick Reference beginner	The content highlights the importance of regular expressions (regex) in Python for text processing. It emphasizes that regex is a crucial tool for manipulating and searching text efficiently in Python programming.
2022-03-27 2022	An Intro To HTTPX beginner	The httpx package is a Python library that provides an alternative to the requests library for making HTTP requests. It offers features like HTTP/2 support, async and await syntax, and better performance. HTTPX aims to be a more modern and efficient tool for handling HTTP requests in Python applications.
2022-03-27 2022	Python Cybersecurity — Build a Port Scanner intermediate	The content discusses creating a Python script for a port scanner to detect open ports on a network. It provides a tutorial on the implementation process.
2022-03-27 2022	10 Advanced Automation Scripts for Your Python Projects intermediate	The content discusses the use of Python for automating tasks in projects. It highlights the importance of automation for handling both interesting and mundane tasks efficiently. The focus is on utilizing Python scripts to automate various processes in projects, making work easier and more streamlined.
2022-03-27 2022	Hacking and Securing Python Applications intermediate	The content discusses 27 vulnerabilities commonly found in Python applications, including risks like arbitrary file writes, directory traversal, and deserialization. It emphasizes the importance of being vigilant about these vulnerabilities to secure Python applications effectively.
2022-03-27 2022	5 Python Libraries That Will Help Automate Your Life beginner	The content discusses five Python libraries that can automate tasks such as sending emails, extracting data from PDFs, and performing data analysis. These libraries offer resources for quick learning and implementation to streamline daily tasks and improve efficiency.
2022-03-27 2022	Malware extraction in Python with Scapy intermediate	Learn how to extract malware files from network captures using Python and Scapy in under 200 lines of code. This tutorial demonstrates a concise method for extracting malicious files from network traffic, showcasing the power and efficiency of Python programming for cybersecurity tasks. By leveraging Scapy, a powerful packet manipulation tool, users can quickly and effectively identify and extract malware files for further analysis or mitigation. This streamlined approach highlights the effectiveness of Python and Scapy for cybersecurity professionals in handling malicious content within network traffic.
2022-01-15 2022	Capturing Network Traffic With Python And TShark intermediate	Capturing Network Traffic With Python And TShark
2022-01-15 2022	10 Handy Automation Scripts You Should Try Using Python beginner	10 Handy Automation Scripts You Should Try Using Python
2022-01-07 2022	Python get all files in directory various examples beginner	Python get all files in directory various examples
2022-01-03 2022	Writing fast async HTTP requests in Python intermediate	Library for optimizing fast async HTTP requests in Python. This resource details the evolution from basic `requests` iterative calls to threading with `queue` and `threading`, finally arriving at asynchronous programming with `aiohttp`. It covers techniques like using `asyncio.Semaphore` for controlled concurrency and explores the trade-offs between different approaches for handling large volumes of network requests locally, aiming for maximum throughput and efficiency.
2021-12-30 2021	Offensive Golang Bonanza: Writing Golang Malware intermediate RCE	Offensive Golang Bonanza: Writing Golang Malware
2021-12-30 2021	Golang Offensive Tools with C-Sto and capnspacehook intermediate RCE	Talk featuring Golang offensive tool developers C-Sto and capnspacehook, discussing Go for red teaming, challenges, and future malware trends. Highlights include C-Sto's goWMIexec and BananaPhone, capnspacehook's pandorasbox, and tools like HackBrowserData, go-netscan, sliver, DeimosC2, and garble for obfuscation and reverse engineering.
2021-12-30 2021	Ben%20 kurtz%20 %20 offensive%20 golang%20 bonanza%20 %20%20 writing%20 golang%20 malware intermediate RCE Talks	Ben%20 kurtz%20 %20 offensive%20 golang%20 bonanza%20 %20%20 writing%20 golang%20 malware
2021-12-15 2021	Bitbucket-Python-Scripts beginner	Bitbucket-Python-Scripts
2021-12-09 2021	Python 201 for Hackers beginner	Library for learning Python for ethical hacking, covering fundamental programming concepts necessary for cybersecurity applications and tool development. This resource is ideal for individuals looking to advance their skills in areas like exploit development and security scripting. The content is structured to build practical abilities, with courses eligible for CEUs and a 24-hour refund policy.
2021-12-06 2021	How to Brute-Force SSH Servers in Python intermediate RCE	Library for brute-forcing SSH servers using Python and the `paramiko` library. This resource details how to implement an SSH brute-force script by iterating through password lists against a target host. It covers connecting to SSH, handling authentication failures and connection timeouts, and utilizing command-line arguments for host, username, and password list input. The script also includes logic to detect and pause on potential rate limiting or quota exceeded errors.
2021-11-28 2021	Quickstart Web3.py 5.22.0 documentation beginner	Library for interacting with the Ethereum blockchain, web3.py offers quickstart documentation covering installation via pip, provider configurations including `EthereumTesterProvider`, `IPCProvider`, `HTTPProvider`, `AsyncHTTPProvider`, `WebSocketProvider`, and `AsyncIPCProvider`. It demonstrates how to connect to local nodes (like Geth on ports 8545 and 8546) and remote node providers, and shows basic usage such as fetching block data via `w3.eth.get_block('latest')`. Further resources on features, APIs, contract interaction, and transaction handling are linked.
2021-11-28 2021	Quickstart Web3.py 5.23.1 documentation beginner	Library documentation for web3.py version 5.23.1 offers a quickstart guide for interacting with the Ethereum blockchain. It details installation via pip, connection methods to Ethereum nodes including IPCProvider, HTTPProvider, and WebSocketProvider, with examples for both local and remote connections. The guide also highlights the use of EthereumTesterProvider for testing and demonstrates how to retrieve block data using `w3.eth.get_block('latest')`.
2021-11-27 2021	Bit Twiddling in Python beginner	Bit Twiddling in Python
2021-11-20 2021	Python Scripting for Hackers Part 1: Getting Started beginner	Library for learning Python scripting for hacking, covering installation of third-party modules like the `python-nmap` module via `pip` and `wget`, fundamental syntax, formatting importance, running files with `chmod`, and incorporating comments. It emphasizes Python's extensive standard libraries and numerous third-party modules available from PyPI for reconnaissance and other hacking tasks.
2021-11-14 2021	A Beginners Guide to Python for Cybersecurity beginner	Library of Python resources for cybersecurity, detailing its application in penetration testing, automation, and malware analysis. It highlights key libraries like NLTK, NumPy, Pandas, Scikit, Nmap, Twisted, Scapy, Beautiful Soup, Cryptography, YARA, Pymetasploit3, and Mechanize. The entry also touches on its use in SOAR platforms and mentions the Flatiron School's Cybersecurity Engineering Bootcamp for practical application.
2021-11-11 2021	Game Hacking with Python and cheat engine intermediate RCE	Game Hacking with Python and cheat engine
2021-11-02 2021	Python Cheat sheet for hackers and developers beginner	Python Cheat sheet for hackers and developers
2021-09-15 2021	How To Track Phone Number Location With Python intermediate OSINT	How To Track Phone Number Location With Python → python.plainenglish.io
2021-08-25 2021	API Testing with HTTPie beginner API Sec	API Testing with HTTPie
2021-08-14 2021	Elliptic Curve Keys Python and Hazmat intermediate	Elliptic Curve Keys Python and Hazmat
2021-08-10 2021	RSA Signatures Python and Hazmat intermediate	This content likely discusses the implementation and usage of RSA signatures in Python, specifically leveraging the `cryptography.hazmat` library. It would cover how to generate RSA keys, sign data using private keys, and verify signatures using public keys. The focus would be on the practical application of these cryptographic operations within a Python environment, utilizing the robust `hazmat` module for secure and efficient handling of RSA cryptography.
2021-06-15 2021	Python Cybersecurity beginner OSINT	This content, titled "Python Cybersecurity," appears to be a brief placeholder or topic introduction. It suggests a focus on the intersection of Python programming and cybersecurity. The content is too minimal to extract specific key points, main ideas, or any details regarding bug bounty payouts. It simply indicates that Python is a relevant tool or language within the cybersecurity domain.
2021-06-07 2021	whey-cewler.py beginner	This content appears to be the name of a Python script, "whey-cewler.py." Without the actual script content, it's impossible to provide a summary of its function or purpose. There is no bug bounty payout amount mentioned.
2021-05-24 2021	Overcoming Issues Using Custom Python Scripts with Burp Suite Professional intermediate Burp	This content focuses on the challenges and solutions associated with using custom Python scripts in Burp Suite Professional. It likely details common problems encountered, such as script integration, error handling, and performance optimization within the Burp Suite environment. The primary goal is to guide users on effectively leveraging Python scripting to enhance Burp Suite's capabilities for web security testing. Specific payout amounts are not mentioned.
2021-01-20 2021	Accessing the Dark Web with Python intermediate	The content discusses using Python to access the Dark Web by creating new Tor identities. This process allows users to browse the Dark Web confidently and safely. By utilizing Python, individuals can enhance their privacy and security while exploring the hidden corners of the internet.
2019-08-26 2019	A Python prompt into a running process: debugging with Manhole intermediate	Library for live debugging Python processes with the Manhole project. This enables attaching an interactive Python prompt to a running application, allowing developers to inspect state, access objects, and diagnose issues beyond standard logging. It discusses security implications, particularly within containerized environments, and provides methods for exposing specific objects and leveraging the garbage collector for debugging.
2019-08-23 2019	10 common security gotchas in Python and how to avoid them intermediate	The content discusses 10 common security pitfalls in Python programming and provides tips on how to avoid them. It emphasizes the challenges of writing secure code and highlights the importance of understanding how to properly use language features, modules, and frameworks to prevent vulnerabilities. By being aware of these common security mistakes and following best practices, developers can enhance the security of their Python applications.
2019-08-23 2019	How to scrape websites with Python and BeautifulSoup beginner	The content discusses the use of Python and BeautifulSoup for web scraping to extract information from websites efficiently. It highlights the vast amount of data available on the internet and the need for tools like BeautifulSoup to gather and process this information. Web scraping allows users to automate the extraction of data from websites for various purposes.
2016-01-21 2016	python/scapy DNS sniffer and parser - Stack Overflow intermediate	Library using Scapy to sniff and parse DNS traffic. The provided Python code demonstrates how to capture UDP packets on port 53, distinguishing between DNS queries (DNSQR) and responses (DNSRR), and extracting timestamp information. → stackoverflow.com

Frequently Asked Questions

What are common Python security vulnerabilities?: Common Python security issues include unsafe deserialization with pickle, command injection through os.system() and subprocess with shell=True, Server-Side Template Injection in Jinja2, path traversal in file operations, SSRF in the requests library, and SQL injection when using string formatting instead of parameterized queries.
Why is Python popular in cybersecurity?: Python's readability, extensive standard library, and rich ecosystem of security packages make it ideal for exploit development, automation, and tool building. Libraries like pwntools, scapy, impacket, and requests are widely used in penetration testing. Python is also the primary language for Burp Suite extensions (via Jython) and many security scanners.
How do you write secure Python code?: Use parameterized queries for database access, avoid pickle for untrusted data (use JSON instead), never use eval() or exec() on user input, use subprocess with shell=False and explicit argument lists, validate and sanitize file paths to prevent traversal, and keep dependencies updated to patch known vulnerabilities.

Weekly AppSec Digest

Get new resources delivered every Monday.

Python

Related Topics

Frequently Asked Questions

Weekly AppSec Digest