Penetration Testing library written in Python
Switch branches/tags
Nothing to show
Clone or download
stikos Merge pull request #2 from pranavvardia/master
fixed security vulnerability
Latest commit dadf25a Oct 18, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
pentest_tools fixed security vulnerability Oct 17, 2018
target_system_reconnaissance Spacing & description (minor) Aug 6, 2018
user_reconnaissance Added proper initial docstring Jul 13, 2018
.gitignore Added DER files to gitignore Jul 2, 2018
LICENSE Created LICENSE Jul 13, 2018
README.md readme update Aug 12, 2018

README.md

Python PenTest Library - PyPen

Penetration Testing library written in Python
A GFOSS project for the Google Summer of Code 2018 programme

Description

Development of a Python library for penetration testers. The library will include a set of tools for performing the basic tasks for attacking a remote host. It will include reconnaissance tools such as modules that will be able to collect data for a specific target either through the web or through user input. Moreover, other tools will be developed to create custom dictionaries for username and password attacks. Other attack techniques that will be supported include DoS attack, and BruteForce attack. The library will also include various statistical functions for extracting additional information from a captured host.

Documentation

There's a detailed documentation section for each module of this project. It contains information regarding:

  • requirements
  • installation
  • usage
  • examples

See Wiki tab

Project plan

See Projects tab

Work Done

This project consists of three main modules:

  • User Reconnaissance & Information Gathering. This module's purpose is to gather information about Facebook users with public information on their profiles, and to create a collection of that information, which will be used in a dictionary attack.
  • Target System Reconnaissance & Information Gathering. A set of functions have been developed in order to get useful information for a target system such as open ports, OS info etc.
  • Attack PenTest Tools. A set of simple tools that try to take advantage of any information gathered with the use of our User Reconnaissance module and Target System Reconnaissance module, in order to succeed in some basic attack techniques.

Future Work

Possible additions or improvements to this project could be the following:

  • An SSH bruteforce module (brutSSH.py), similar to bruftp.py
  • The improvement of pydos_scapy.py, as it is not very effective at the moment, plus the improvement of the simple socket implementation, in order for the script to be cross platfrom and not depend on hping3
  • An extension of the User Reconnaissance module so that it covers a wider variety of social networks, such as Instagram, Twitter, LinkedIn etc.
  • A distributed, online password cracking module, based on our User Reconnaissance data, that will possibly use spoofed IPs to ensure a large number of attempts.

Contributors

Developer

  • Konstantinos Christos Liosis

Mentors

Organization

Open Technologies Alliance - GFOSS

Final Report (Gist)

gsoc18_pypen_report.md

Disclaimer

The purpose of this library is educational, for Penetration Testing and Ethical Hacking and under no circumstances for malicious actions. It's use will comply to all current data protection legislation.