python_security
Overview
This repository collects lists of security-relavent Python APIs, along with examples of exploits using those APIs. Currently it only contains remote code/command execution libraries.
Usage
To work with the code in this repo, you must be in a virtual environment:
$ cd /path/to/python_security
$ python3.8 -m venv venv
$ source venv/bin/activate
(venv) $ pip3.8 install -r requirements.txt
Interactive Server
You can launch the server to interactively play with the examples:
(venv) $ FLASK_APP=webapp.app.py FLASK_ENV=development flask run -h localhost -p 2121
This will let you generate payloads for arbitrary code, and run those payloads on your own machine.
JSON Formatted Data
All the vulnerable functions covered by this repository are available in machine-readable format in sinks.json. sinks.json can be regenerated by running scripts/generate_sink_list.py.
Testing
When adding a new exploit, you can validate it by running the tests:
(venv) $ python3 -m unittest
Contributing
PRs are welcome. If you're looking for ideas, look at the "Future Work" section in code_execution/README.md. Before submitting an exploit, make sure to run the tests and include evidence of testing in the PR.