https://github.com/gbleaney/python_security

This repository collects lists of security-relavent Python APIs, along with examples of exploits using those APIs
https://github.com/gbleaney/python_security

Last synced: 6 days ago
JSON representation

This repository collects lists of security-relavent Python APIs, along with examples of exploits using those APIs

• Host: GitHub
• URL: https://github.com/gbleaney/python_security
• Owner: gbleaney
• License: mit
• Created: 2021-03-25T19:38:34.000Z (over 3 years ago)
• Default Branch: main
• Last Pushed: 2021-05-09T20:26:09.000Z (over 3 years ago)
• Last Synced: 2024-08-03T02:02:51.367Z (4 months ago)
• Language: Python
• Size: 411 KB
• Stars: 34
• Watchers: 4
• Forks: 6
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-vulnerable-apps - python_security - This repository collects lists of security-relavent Python APIs, along with examples of exploits using those APIs (Uncategorized / Firmware)

README

        
# python_security

## Overview

This repository collects lists of security-relavent Python APIs, along with examples of exploits using those APIs. Currently it only contains remote code/command execution libraries.

## Usage

To work with the code in this repo, you must be in a virtual environment:

```

$ cd /path/to/python_security

$ python3.8 -m venv venv

$ source venv/bin/activate

(venv) $ pip3.8 install -r requirements.txt

```

### Interactive Server

You can launch the server to interactively play with the examples:

```

(venv) $ FLASK_APP=webapp.app.py FLASK_ENV=development flask run -h localhost -p 2121

```

This will let you generate payloads for arbitrary code, and run those payloads on your own machine.

### JSON Formatted Data

All the vulnerable functions covered by this repository are available in machine-readable format in `sinks.json`. `sinks.json` can be regenerated by running `scripts/generate_sink_list.py`.

### Testing

When adding a new exploit, you can validate it by running the tests:

```

(venv) $ python3 -m unittest

```

## Contributing

PRs are welcome. If you're looking for ideas, look at the "Future Work" section in `code_execution/README.md`. Before submitting an exploit, make sure to run the tests and include evidence of testing in the PR.