appsec.fyi › Python

Python Resources

Page 4 of 6: resources 151–200 of 291, added May 2025 to Apr 2026.

The newest Python resources are on the Python page. For a reading order instead of a date order, see the Python learning path.

Date AddedLinkExcerpt
2026-04-06 2026Rapid Exploitation and Clever Malware in the Supply Chain — Last Week in AppSec news 4 min readSurvey of recent supply chain attacks, including the Langflow code injection vulnerability (CVE-2026-33017) added to the CISA KEV database and the Telnyx Python framework compromise. The Telnyx attack leveraged .wav audio files to conceal malicious payloads that harvested and exfiltrated information. The article also references a JFrog technical analysis of the Telnyx malware. → checkmarx.com
2026-04-06 2026CrewAI contains multiple vulnerabilities including SSRF, RCE intermediate 3 min read SSRFVulnerabilities in CrewAI include CVE-2026-2275 (RCE via Code Interpreter Tool fallback), CVE-2026-2286 (SSRF via RAG search), CVE-2026-2287 (RCE via Docker fallback), and CVE-2026-2285 (arbitrary file read via JSON loader). Attackers can chain these, exploiting prompt injection to achieve RCE, arbitrary file reads, and SSRF, potentially leading to credential theft or further system compromise. Mitigation involves restricting the Code Interpreter Tool, avoiding `allow_code_execution=True`, sanitizing input, and monitoring Docker status.
2026-04-06 2026CVE-2026-33873: Langflow Agentic Assistant RCE Vulnerability news 4 min readAnalysis of CVE-2026-33873 in Langflow details a critical code injection vulnerability (CWE-94) in the Agentic Assistant feature. Versions prior to 1.9.0 incorrectly execute LLM-generated Python code during validation, allowing attackers to achieve arbitrary server-side Python execution by manipulating AI output. This network-accessible vulnerability requires low privileges and can lead to system compromise. Mitigation involves upgrading to Langflow 1.9.0 or later, or disabling the Agentic Assistant feature. → sentinelone.com
2026-04-06 2026CVE-2026-34519: AIOHTTP XSS Vulnerability news 4 min readLibrary for detecting and mitigating CVE-2026-34519, an HTTP Response Splitting vulnerability in AIOHTTP versions prior to 3.13.4. This flaw, classified as CWE-113, allows attackers to inject arbitrary HTTP headers by controlling the `reason` parameter in `Response` objects, potentially leading to cache poisoning or cross-site scripting. The library assists in identifying affected applications and provides mitigation strategies, including upgrading AIOHTTP, input sanitization for CRLF characters, and WAF rule implementation. → sentinelone.com
2026-04-05 2026Known Unpatched Exploitable: Redashs Python Sandbox Escape Gives Attackers Full Server Access news 3 min readWriteup of a Redash sandbox escape vulnerability, exploitable via the Python data source, allowing remote code execution and full server compromise. OX Research discovered that an insecure reassignment of Python's `getattr` function within the sandbox context enables attackers to access and execute arbitrary system commands, leading to potential data exposure and lateral movement. All Redash versions with the Python data source enabled are affected, with no patch currently available. → ox.security
2026-04-03 2026A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI advancedA Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI → arxiv.org
2026-04-03 2026Exposing 4 Critical Vulnerabilities in Python PickleScan | Sonatype news 5 min read DeserWriteup of four critical vulnerabilities discovered in the Python security tool picklescan. CVE-2025-1716 allows arbitrary code execution, bypassing static analysis. CVE-2025-1889 fails to detect hidden files relying on extensions. CVE-2025-1944 is vulnerable to ZIP filename tampering, causing crashes but allowing model loading. CVE-2025-1945 fails to detect malicious files when ZIP file flag bits are modified. These issues impact AI/ML model security and were addressed in picklescan version 0.0.23. → sonatype.com
2026-04-03 2026Python SAST Tools: Free & Paid Solutions for Secure Code Analysis beginner 4 min readLibrary providing Static Application Security Testing (SAST) for Python, employing lexical, control flow, data flow, and semantic analysis to detect vulnerabilities. It details open-source tools like Bandit and Semgrep, and commercial solutions such as Checkmarx, Veracode, GitHub Advanced Security, and GitLab SAST. The library emphasizes IDE plugin and CI/CD integration for "Shift Left Security" practices, enabling early detection and remediation of issues like injection flaws and hard-coded secrets.
2026-04-03 202610 Common Security Gotchas in Python and How to Avoid Them beginner10 Common Security Gotchas in Python and How to Avoid Them
2026-04-03 2026Insecure Deserialization in Python | Semgrep intermediate 5 min readLibrary for detecting insecure deserialization vulnerabilities in Python code, focusing on the dangers of libraries like `pickle`, `dill`, `jsonpickle`, and `shelve` when processing untrusted input. It highlights how these libraries can lead to remote code execution and provides examples of exploitation, including a demonstration with `pickle.dumps` and `os.system`. The library's rules identify data flow from untrusted sources to sensitive deserialization functions, offering practical recommendations to avoid risks such as avoiding `pickle` for untrusted data, using safer alternatives like JSON or `PyYAML`'s `safe_load`, and integrating Semgrep scans into CI pipelines. Specific mitigations for Django, NumPy, and PyTorch are also mentioned.
2026-04-03 2026PyTorch Users at Risk: 3 Zero-Day PickleScan Vulnerabilities | JFrog news 11 min read DeserLibrary for detecting vulnerabilities in PyTorch models. JFrog Security Research discovered three zero-day vulnerabilities in PickleScan, the industry-standard tool for scanning pickle-based models. These bypasses, including CVE-2025-10155, allow attackers to embed undetected malicious code within PyTorch models, leading to potential supply chain attacks. PickleScan's reliance on file extension checks over content analysis, and its blacklist approach, create these exploitable gaps. → jfrog.com
2026-04-03 2026PickleScan - Security Scanner Detecting Suspicious Python Pickle Files beginner 2 min readTool for scanning Python Pickle files for malicious code execution. PickleScan detects dangerous global imports like `eval()` within pickle data, supporting analysis of local files, directories, URLs, and Hugging Face models. It offers filtering capabilities for directory scans and exit codes similar to ClamAV. The tool draws upon research from various security experts and events, including discussions on backdooring pickle files and arbitrary code execution vulnerabilities.
2026-04-03 2026Python Secure Coding Guidelines beginnerPython Secure Coding Guidelines
2026-04-03 2026Bandit: Python Static Application Security Testing Guide beginner 3 min readLibrary for static analysis of Python code, Bandit identifies security vulnerabilities like insecure cryptography (B303, B304), use of `assert` (B101), `eval`/`exec` (B102, B307), hardcoded secrets (B105), `pickle` (B301), and `subprocess` issues (B602). It integrates into development workflows and CI/CD pipelines, generating detailed reports for remediation. Complementary tools include Safety and pytest.
2026-04-03 2026Python Security Vulnerabilities | Top Issues | Aikido beginner 25 min readLibrary for identifying and mitigating common Python security vulnerabilities. It details risks like arbitrary code execution via `eval()` and `exec()`, OS command injection through `subprocess` and `os.system`, and the dangers of hardcoded secrets. The library emphasizes practical mitigation techniques, such as avoiding unsafe function usage, using argument lists with `subprocess`, and employing secure secret management practices. It highlights how SAST tools can detect these patterns early in development. → aikido.dev
2026-03-03 2026Show HN: Drawbridge – Drop-In SSRF Protection for Python | Hacker News intermediate SSRFLibrary for drop-in SSRF protection for Python applications, replacing `requests` or `httpx`. Drawbridge resolves DNS, validates all IPs against private/reserved ranges, pins connections by rewriting URLs to validated IPs, and re-validates on redirects. This method effectively blocks DNS rebinding, address obfuscation, and redirect-based SSRF attacks.
2026-01-17 2026pwviptbl/ProxyHunter: Aplicação Python com interface gráfica que permite configurar regras de interceptação para modificar parâmetros de requisições HTTP. Quando o navegador envia uma requisição para uma rota configurada, o proxy intercepta, modifica apenas os parâmetros especificados e encaminha a requisição mantendo todos os outros parâmetros originais. intermediate 12 min read API Sec BurpTool that intercepts HTTP requests to modify specific parameters. ProxyHunter is a Python application with a graphical interface that allows users to configure interception rules for HTTP requests. It intercepts requests to configured routes, modifies only specified parameters, and forwards the request while preserving all other original parameters. Features include a GUI, multiple rule configuration, GET and POST support, individual rule activation/deactivation, JSON persistence, configurable port, manual interception, WebSocket support, an advanced Intruder, and a vulnerability scanner detecting SQL Injection, XSS, CSRF, Path Traversal, and exposed sensitive information.
2026-01-12 2026dr34mhacks/jwtauditor: JWT Auditor – Analyze, break, and understand your tokens like a pro. intermediate 3 min read JWTLibrary for comprehensive JWT security testing, enabling penetration testers to decode, analyze, and exploit tokens. It features automated vulnerability detection for 15+ types, including algorithm confusion attacks, KID parameter injection, and JKU/X5U manipulation. JWTAuditor also supports secret bruteforcing, token editing, and generation, with all processing handled client-side for privacy. It includes built-in wordlists and custom support, detailed explanations for findings, and guides on JWT fundamentals and attack techniques.
2025-12-24 2025yo-yo-yo-jbo/python_for_researchers: Python for offensive security research beginner 11 min readLibrary for offensive security researchers demonstrating advanced Python techniques. It details how to execute Python code from C using dynamic library loading of `libpythonX.Y.so`, leveraging functions like `Py_Initialize` and `PyRun_SimpleString`. Conversely, it explores using Python's `ctypes` module for low-level Windows API interactions, such as implementing a DLL injector by calling `CreateToolhelp32Snapshot`, `OpenProcess`, `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
2025-12-03 202530 low-high level honeypots in a single PyPI package beginner Supply Chainhttps://t.co/sH0hx43Dcp
2025-11-09 2025Exploring HTTPS With Python beginner 36 min readTutorial on building Python HTTPS applications, covering HTTP fundamentals, the role of TLS/SSL in securing communications, analyzing network traffic, applying cryptography, and understanding Public Key Infrastructure (PKI). It guides users through creating their own Certificate Authority and building a secure Python HTTPS server using Flask, including identifying common warnings and errors. → realpython.com
2025-10-12 2025I Tried Automating My Entire Browser with Python — Now I Barely Click Anything intermediateI Tried Automating My Entire Browser with Python — Now I Barely Click Anything How Selenium, Playwright, and a few tricks turned me into a lazy automation wizard 1. I Was Tired of Logging In 10 …
2025-10-12 2025How I Built 6 Micro-Tools in Python That Earn Me Passive Income Daily beginnerHow I Built 6 Micro-Tools in Python That Earn Me Passive Income Daily I stopped chasing big projects and started building tiny, high-impact Python scripts. These libraries helped me automate, scale … → python.plainenglish.io
2025-08-14 2025Writing API exploits in Python intermediate 7 min readLibrary for generating Python API exploit proof-of-concepts, focusing on BOLA vulnerabilities within the crAPI project. It demonstrates converting requests captured in Burp Suite's Repeater or Intruder into executable Python code using the `curlconverter` tool. The process involves cleaning up `curl` commands, transpiling them to Python, and then refining the generated code for better usability, incorporating features like argument parsing for target URLs and report IDs. → danaepp.com
2025-08-14 2025GitHub - paulpierre/markdown-crawler: A multithreaded ?️ web crawler that r intermediate 4 min readTool for multithreaded web crawling that converts pages into markdown files. Primarily designed for large language model document parsing, simplifying RAG and LLM fine-tuning use cases by normalizing large documents. Features include threading, resuming crawls, configurable depth, and support for tables and images. It utilizes BeautifulSoup for HTML parsing and offers a CLI interface for direct use.
2025-08-14 2025GitHub - Fadi002/de4py: toolkit for python reverse engineering intermediate 2 min readLibrary for Python reverse engineering; de4py offers automatic and manual deobfuscation tools with a PySide6 UI. It supports common packers and integrates with local LLMs via Ollama for AI-assisted deobfuscation of heavily obfuscated code, utilizing models like qwen2.5-coder:1.5b. The toolkit is structured with core logic, deobfuscator engines, a user interface, and utilities, and is available under a non-commercial license.
2025-08-14 2025How to store your users' API keys securely in Django ? intermediate 2 min readLibrary for securely encrypting and storing user API keys in Django applications. This solution involves generating a Fernet encryption key, storing it in environment variables, and creating a Django model to manage encrypted keys. The guide details setup, model creation, frontend development with forms and views, template integration, and final deployment steps, offering an alternative of offloading encryption to services like AWS KMS.
2025-08-14 2025Let’s create a Python Debugger together: Part 1 | Mostly nerdless intermediate 10 min readLibrary implementing a Python debugger from scratch, starting with a `breakpoint()` function-based version. This library allows users to set breakpoints, inspect local variables using `sys._getframe()`, and execute arbitrary Python code within the context of the interrupted function. It extends the built-in `pdb` functionality by providing a simplified interface for debugging Python scripts.
2025-08-14 2025The easy way to concurrency and parallelism with Python stdlib beginner 9 min readLibrary utilizing Python's standard library `concurrent.futures` module, specifically `ThreadPoolExecutor` and `ProcessPoolExecutor`, for simplified concurrency and parallelism. This resource demonstrates how to effectively manage tasks like web scraping or file operations without the complexity often associated with these concepts, providing concrete examples of code implementation.
2025-08-14 2025Pygoat - Learn Django security the hard way - Speaker Deck beginner 9 min read Bug BountyLibrary for learning Django security by attacking and securing Pygoat, an intentionally vulnerable Python application. It covers OWASP Top 10 vulnerabilities like Sensitive Data Exposure (CWE-259, CWE-327, CWE-331) and Injection flaws (SQL, NoSQL, OS command, ORM, LDAP, EL/OGNL), offering mitigation strategies such as proper access control, input validation, parameterized queries, and disabling debug modes. The resource also emphasizes secure design patterns, threat modeling, and maintaining up-to-date software components.
2025-08-14 2025Click and Python: Build Extensible and Composable CLI Apps – Real Python beginner 48 min readLibrary for building extensible and composable Python command-line interfaces. It offers a more flexible and intuitive alternative to `argparse`, leveraging decorators to easily add arguments, options, and subcommands. Click handles type-aware input processing and automatically generates usage and help pages, streamlining CLI development. → realpython.com
2025-08-14 2025Asyncio, twisted, tornado, gevent walk into a bar... beginner 18 min readLibrary for asynchronous I/O in Python, featuring frameworks like asyncio, twisted, tornado, and gevent. These tools manage concurrent network operations efficiently by allowing other program parts to execute while waiting for external responses, significantly speeding up tasks such as web crawling or server operations. The library demonstrates this with an example fetching titles from multiple URLs, showing dramatic performance improvements over synchronous methods.
2025-08-14 2025How to Launch an HTTP Server in One Line of Python Code – Real Python beginner 27 min readLibrary for launching a basic HTTP server with a single Python command. Utilize the `http.server` module to serve static files from any directory, specifying ports like 8000 or 8080, and binding to specific interfaces with the `-b` option. Restrict access by binding to `127.0.0.42` or use administrative privileges with `sudo` to serve on port 80. The `-d` option allows serving content from an alternative directory, bypassing potential import conflicts. → realpython.com
2025-08-14 2025Build a Vulnerability Scanner Using Python intermediate 7 min readLibrary for building a vulnerability scanner in Python, this resource details a process that begins with converting a port scanner into a class. The script then prompts for target IP, port range, and a file listing known vulnerable software banners. It scans for open ports, retrieves service banners, and compares them against the provided vulnerability list to identify and report exploitable services.
2025-08-14 2025Build an Arp Spoofer From Scratch | by Rahul Kumar | Jan, 2023 | System Wea intermediateThe content appears to be about creating an ARP spoofer from scratch, authored by Rahul Kumar in January 2023. ARP spoofing is a technique used for network manipulation by sending false Address Resolution Protocol (ARP) messages. The article likely provides instructions or insights on how to build this tool independently.
2025-08-14 2025Creating an Advanced Network Packet Sniffer in Python: A Step-by-Step Guide intermediateThe content is a guide on building an advanced network packet sniffer using Python. It likely provides a detailed, step-by-step approach to creating a tool that can intercept and log network traffic for analysis or monitoring purposes. The guide may cover topics such as capturing packets, analyzing their contents, and potentially implementing additional features to enhance the functionality of the packet sniffer. Overall, it aims to help readers understand the process of developing a network packet sniffer using Python.
2025-08-14 2025Python Simple HTTP Server With SSL Certificate (Encrypted Traffic) | Python intermediateThe content appears to be about setting up a Python Simple HTTP Server with an SSL certificate to enable encrypted traffic. This setup allows for secure communication over the network by encrypting data exchanged between the server and clients. The use of SSL certificates ensures that the data transmitted is protected from unauthorized access or interception. This setup is beneficial for enhancing the security of web applications or services that require secure communication protocols. → python.plainenglish.io
2025-08-14 2025Python Decorators (made easy). Decorator can be used to send function… | by beginnerThe content seems to be about Python decorators, which are used to modify or extend the behavior of functions in Python. Decorators are a powerful tool that can be used to add functionality to existing functions without modifying their code. They are commonly used for tasks like logging, authentication, and performance monitoring. Decorators are a key feature in Python that allows for cleaner and more modular code.
2025-08-14 2025Python Requests Library Caused a Production Outage | by Daryan Hanshew | Ju newsThe Python Requests library caused a production outage, as reported by Daryan Hanshew. The incident likely involved issues or errors related to the use of the Python Requests library, impacting the production environment.
2025-08-14 2025microsoft/picologging: An optimized logging library for Python beginner 3 min readLibrary for high-performance Python logging, picologging offers a drop-in replacement for the standard library's `logging` module, boasting 4-17x speed improvements. It maintains API compatibility, allowing seamless integration into existing applications. Installation is available via pip or conda, and developers can utilize its CPython 3.11 components for enhanced compatibility and debugging capabilities.
2025-08-14 2025TryHackMe | Python Basics. In this story I will be sharing my… | by Mukkara beginnerThe content appears to be about a story shared by Mukkara on TryHackMe regarding Python basics. The story likely includes insights, experiences, or tutorials related to Python programming fundamentals. Mukkara may be sharing tips, tricks, or lessons learned while exploring Python basics on the TryHackMe platform. The content seems to focus on practical applications or explanations of Python concepts for beginners or those interested in learning more about Python programming.
2025-08-14 20256 Python Libraries For Cyber Security Professionals and Ethical Hackers | b beginnerThe content mentions 6 Python libraries useful for cyber security professionals and ethical hackers. These libraries likely provide tools and functions that can assist in tasks related to cybersecurity, such as threat detection, vulnerability analysis, or penetration testing. Python is a popular programming language in the cybersecurity field due to its versatility and ease of use for developing security tools and scripts. The libraries mentioned may offer pre-built functionalities that can streamline and enhance the work of professionals in the cybersecurity and ethical hacking domains. → python.plainenglish.io
2025-08-14 2025RegEx in Python: Introduction and The use of Backslash | by Manash Bhele | beginnerThe content titled "RegEx in Python: Introduction and The use of Backslash" by Manash Bhele likely discusses regular expressions (RegEx) in Python, introducing the concept and focusing on the use of the backslash (\) character within regular expressions. The article may delve into how backslashes are utilized in Python's RegEx to escape special characters or create specific patterns for matching text. It is a beginner-friendly guide that aims to explain the basics of using RegEx in Python with a particular emphasis on understanding and applying the backslash in regular expressions.
2025-08-14 2025How to Create a Reverse Shell in Python - The Python Code intermediate 6 min readLibrary for creating reverse shells in Python. This resource details the implementation of both server (attacker) and client (target) code, enabling remote execution of system commands like `cmd.exe` or `bash/zsh` and bypassing firewalls by initiating connections from the target to the attacker. It covers socket programming, command execution via `subprocess`, directory traversal with `os.chdir`, and message passing with a custom separator.
2025-08-14 2025(304) Remote Procedural Call via XML-RPC in 5 minutes - YouTube beginnerThe content is a video tutorial on YouTube titled "(304) Remote Procedural Call via XML-RPC in 5 minutes." It likely provides a quick guide or demonstration on how to perform remote procedural calls using XML-RPC within a short timeframe. The video may offer step-by-step instructions or examples to help viewers understand and implement XML-RPC for remote communication.
2025-08-14 2025A Python prompt into a running process: debugging with Manhole intermediate 4 min readLibrary for live debugging of running Python processes. Manhole enables an interactive Python prompt attached to a live process, allowing inspection of variables and state. It uses Unix domain sockets and can be accessed via tools like `socat`. While useful for diagnosing unexpected behavior, its use in production carries risks of unintended modifications and highlights a need for robust logging and monitoring. The library supports exposing specific objects or using the garbage collector to access program state.
2025-08-14 2025Python monkey-patching like a boss | by Sergei | Medium intermediateThe content appears to be about monkey-patching in Python, a technique that allows developers to dynamically modify or extend the behavior of classes or modules at runtime. Monkey-patching can be a powerful tool when used carefully, but it can also lead to unexpected behavior and should be approached with caution. The article likely discusses best practices, examples, and considerations for effectively implementing monkey-patching in Python.
2025-08-14 2025pikepdf/pikepdf: A Python library for reading and writing PDF, powered by QPDF beginner 4 min readLibrary for reading, writing, repairing, and transforming PDFs in Python. Built on the qpdf C++ library, pikepdf offers automatic PDF repair, XMP metadata editing, robust encryption support (AES-256, AES-128, RC4), and linearization for fast web viewing. It provides a Pythonic API for low-level manipulation and object access, along with lossless image extraction and Jupyter integration. Binary wheels are available for all major platforms, simplifying installation.
2025-05-24 2025Django Security Best Practices: A Comprehensive Guide for Software Engineers - Corgea - Home beginner 5 min readLibrary for hardening Django applications, detailing best practices against threats like XSS, SQL injection, and CSRF. It covers updating Django versions, enabling HTTPS with `SECURE_SSL_REDIRECT`, using strong `SECRET_KEY` management, securing databases, and leveraging Django's built-in features like `SecurityMiddleware`, Content Security Policy via `django-csp`, and `X_FRAME_OPTIONS`. The resource also addresses authentication hardening with `AUTH_PASSWORD_VALIDATORS` and packages like `django-otp`, dependency auditing using `pip-audit`, and comprehensive logging.
2025-05-07 2025Using JWTs in Python Flask REST Framework | AppSignal Blog intermediate 8 min read API Sec AuthNLibrary implementing JSON Web Tokens (JWTs) for secure authentication in Python Flask REST frameworks. It details JWT structure (header, payload, signature), benefits like stateless sessions and efficiency, and provides practical examples for user registration, login, token creation using `Flask-JWT-Extended`, and securing API endpoints with `@jwt_required()`. The entry also covers implementing refresh tokens for longer sessions and managing token expiration.