awesome-python/website/data/category_intros/penetration-testing.md

With permission to test a web app, intercept its traffic in mitmproxy and test its inputs for SQL injection with sqlmap: two Python penetration testing tools.

How to choose:

• Intercepting, inspecting, and scripting HTTP(S) traffic: mitmproxy
• Detecting and exploiting SQL injection in a web app: sqlmap
• Windows network protocols like SMB, MSRPC, and Kerberos: Impacket
• Writing exploits and solving CTF challenges: pwntools
• Finding a username's accounts across social networks: Sherlock

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with 3 front ends to the same core: mitmproxy in the console, mitmweb in the browser, and mitmdump on the command line. It starts as a regular HTTP proxy on localhost:8080, so point your browser or device at it, then visit mitm.it to install the mitmproxy CA certificate, which lets it decrypt HTTPS. To script the traffic, write an addon: a module with a request(flow) function is enough. Load it with -s.

sqlmap automates detecting and exploiting SQL injection flaws and taking over database servers. Pass it a URL with a parameter, and it finds the vulnerable parameter, the injection techniques that work, and the back-end database.

Impacket is a collection of Python classes for working with network protocols, with low-level access to packets and, for protocols like SMB and MSRPC, the protocol implementation itself. The scripts it ships are tools written as examples of what the library can do.

pwntools is a CTF framework and exploit development library, split into 2 modules: pwn for CTFs and pwnlib as a clean Python library. from pwn import * gives you everything you need to write an exploit, but it also puts your terminal in raw mode and parses sys.argv, so import pwnlib when pwntools is part of another project. Either way, tubes give you one interface to talk to processes, sockets, and SSH sessions.

Sherlock hunts down social media accounts by username. Run sherlock user123, or pass several usernames at once, and it saves the accounts it finds to a text file per username, like user123.txt.

Run any of these tools only against systems you own or have explicit permission to test. That's sqlmap's answer to where to practice, and every sqlmap run prints a disclaimer that attacking targets without prior mutual consent is illegal.