A curated GitHub index of Python libraries for pentesting, reverse engineering, fuzzing and malware analysis, maintained for whitehat professionals working on authorized engagements.

dloss/python-pentest-tools is not a tool in the executable sense but rather a curated index — a single README on GitHub, MIT-licensed and sitting at roughly 2,886 stars on the master branch, that catalogs Python libraries useful to security practitioners. Its author frames it plainly: if you work in vulnerability research, reverse engineering or pentesting, Python deserves a place in your workflow because of its unusually rich ecosystem of security-relevant libraries. The list organizes that ecosystem into thematic sections so an operator can jump from Network to Malware analysis to PDF tooling without wading through PyPI search results.

What makes this repository analytically interesting is not just what it includes but what it excludes, and the reasoning the maintainer documents. The README states that more aggressive categories — pentest frameworks, Bluetooth smashers, web application vulnerability scanners, war-dialers — are deliberately left out because the legal situation around such tools remains murky in Germany, even after a decision by the country's highest court (Bundesverfassungsgericht, linked in the README). This is a rare instance of an awesome-list with an explicit legal threat model behind its editorial policy, and it signals that the list is intentionally curated toward defensible, whitehat-appropriate tooling. The maintainer says as much: the list is meant to help whitehats, and they prefer to err on the safe side.

The Network section is the deepest, and it spans several architectural layers. At the packet level sit Scapy (send, sniff, dissect and forge packets, usable interactively or as a library), dpkt (fast, simple packet creation and parsing with basic TCP/IP protocol definitions) and Impacket (crafting and decoding packets with higher-level protocol support such as NMB and SMB). Several alternative Python bindings for libpcap are listed together — pypcap, Pcapy, Pcapy-NG and the libpcap PyPI package — which is genuinely useful for anyone deciding which binding to standardize on. Low-level plumbing is covered by libdnet for interface lookup and Ethernet frame transmission.

Above raw packets, the network section moves into enumeration and interception territory. SMBMap enumerates Samba share drives across a domain, Knock Subdomain Scan and SubBrute handle wordlist-driven and fast subdomain enumeration respectively, and AutoRecon provides multi-threaded network reconnaissance. Mitm6 is listed as an IPv6-based man-in-the-middle tool that abuses IPv6 features, while Mallory is described as an extensible TCP/UDP MITM proxy supporting on-the-fly modification of non-standard protocols — both strictly in the context of authorized internal testing. Active Directory work is represented by BloodHound.py, which appears twice in the list, described as a Python alternative for AD enumeration and mapping attack paths, plus a more recent addition, Dark-Moon, an autonomous AI penetration testing platform under GPL-3.0 covering web, API, Active Directory and Kubernetes with proof of exploitation. There is also Pytbull-NG, an IDS/IPS testing framework shipped with more than 300 tests, which is arguably one of the most defense-oriented entries in the entire catalog.

The Debugging and reverse engineering section reads like a history of the discipline alongside its present. Classic entries include Paimei with its PyDBG component, PyEMU for scriptable IA-32 emulation, PyDbgEng wrapping the Microsoft Windows Debugging Engine and IDAPython bridging Python into IDA Pro. Modern heavyweights are equally represented: Frida for dynamic instrumentation by injecting scripts into running processes, Capstone for multi-architecture disassembly, Unicorn Engine for CPU emulation, Keystone for assembly, diStorm for AMD64 and Androguard for Android application analysis. Firmware and hardware security get CHIPSEC, the framework for analyzing PC platforms including BIOS/UEFI, and Ghidrathon — the README's spelling — is included as Mandiant's FLARE extension adding Python 3 scripting to Ghidra. A newer pure-ctypes entry, PyMemoryEditor, offers Cheat Engine-style memory scanning and pointer chains across Windows, Linux and macOS.

The Fuzzing section mixes generational and mutation-based approaches. Sulley is the classic fuzzer development framework, Peach Fuzzing Platform covers both generation and mutation (its v2 being Python-written), afl-python wires American fuzzy lop fork-server instrumentation into pure-Python targets, and untidy fuzzes XML. Supporting infrastructure matters here too: Construct, which lets you declare binary or textual data structures declaratively for parsing and building, is the kind of library that quietly underpins a great deal of custom protocol work. Powerfuzzer rounds out the section as an HTTP-focused web fuzzer, and Fusil provides a library layer for writing fuzzing programs directly.

The Web section is intentionally modest, consistent with the maintainer's caution about scanners. Requests, lxml, HTTPie, Twill and spynner form a client-side toolkit for interacting with and testing web applications, while mitmproxy provides an SSL-capable intercepting HTTP proxy whose console permits inspection and editing of flows in real time — a staple of authorized web application assessment. XSStrike appears as an advanced XSS detection suite, FunkLoad as a functional and load tester, spidy as a simple command-line crawler with word scraping, and Waymap as a web vulnerability scanner built for penetration testers. Note the tension: the intro disclaims web application vulnerability scanners, yet a few lightweight ones appear later — evidence the list has accepted community contributions over time.

Arguably the sections most valuable to defensive teams are Forensics and Malware analysis. Volatility extracts digital artifacts from RAM samples, Rekall is Google's memory analysis framework, and TrIDLib identifies file types from binary signatures. Malware analysis entries include pyew (command-line hex editor and disassembler), yara-python from VirusTotal for identifying and classifying samples, jsunpack-n (a generic JavaScript unpacker that emulates browser functionality to detect browser-targeting exploits), CapTipper for exploring and reviving malicious HTTP traffic from PCAP files, phoneyc as a pure-Python honeyclient, Cuckoo for automated analysis and CAPE for configuration and payload extraction. Exefilter is notable for defensive mail and web filtering: it detects many file formats and can strip active content.

Smaller sections round out the picture. The PDF group (pdfminer.six, peepdf-3, Didier Stevens' PDF tools, pyPDF) reflects how central PDFs once were to client-side exploitation and phishing triage. Misc mixes heavyweight binary analysis (Angr, described as a powerful framework for vulnerability research and exploit development), cloud auditing (ScoutSuite), OSINT graph building (Exomind), word mangling (PyMangle, listed twice), AD certificate services work (Certipy) and wmiexec.py from the Impacket examples. The closing libraries section — Jupyter, Beautiful Soup, matplotlib, Mayavi — acknowledges that reporting, parsing and visualization are part of the operator's job too.

For a working professional, the practical value of dloss/python-pentest-tools is as a map and a curriculum. Because most entries link directly to their upstream repositories or documentation, it doubles as an onboarding path: a junior analyst could traverse the Malware analysis section, install each tool in a lab VM, and end up with a credible triage capability. Two illustrative, non-weaponized examples of the kind of workflow the list supports: pip install yara-python for sample classification, or pip install mitmproxy for inspecting your own test traffic in a lab environment. The usual caveats apply — entries age at different speeds, a handful of links point to defunct hosting like Google Code, and nothing here substitutes for verifying the current upstream state of each project before relying on it in a client engagement.

From a defensive perspective the list is also worth reading as reconnaissance into what tooling an authorized tester is likely to bring to your environment. Familiarity with BloodHound.py collection behavior, mitm6's IPv6 router-advertisement pattern, Scapy-style crafted packets or SMBMap enumeration sweeps all translate directly into detection content. That dual readability — offensive utility and defensive awareness in one document — is the quiet strength of a well-curated index, and it explains why this particular one has remained a reference point in the security community for so long.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• USBArmyKnife for close-access red team hardware operations


• digital-forensics-lab for hands-on forensic training and case study practice


• nmap-vulners for turning service scans into ranked CVE and exploit intelligence