Offensive Security Python Packages

ptai

The most autonomous pentesting AI on the market. MCP server + Python agents with 150+ security tools, exploit chaining, and PoC validation.

defaultcreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

wfh-wordlist

The most comprehensive wordlist generation toolkit for pentest, red team, and security research. 25 subcommands: charset, profile, corp-users, default-creds, password-dna, DNS fuzzing, web scraping, ISP keygen, ICS/SCADA credentials, ML training, pipal analysis, and more. Python 3.8+ | pip install wfh-wordlist

python-obfuscation-framework

Obfuscate Python code, stage payloads, and evade defenses

subsurfer

Recon Subdomain Scan Tool

binsmasher

Binary auditing and automatic RCE generator

reait

RevEng.AI Toolkit and Python API

0xpwn

Fully AI Agentic Pentesting & Security toolkit

gitlab-harvester

Global term search for GitLab via gitlab-python

basilisk-ai

Basilisk — Open-source AI red teaming framework with genetic prompt evolution. Automated LLM security testing for GPT-4, Claude, Grok, Gemini. OWASP LLM Top 10 coverage. 32 attack modules.

endabyss

Recon Crawling Endpoint and Parameter Scan Tool

black-widow

GUI based offensive penetration testing tool (Open Source)

raccoon-scanner

Offensive Security Tool for Reconnaissance and Information Gathering

bot-safe-agents

A library for fetching a list of bot-safe user agents.

sentinel-llm-security

AI Security Platform: Defense (61 Rust engines + Micro-Model Swarm) + Offense (39K+ payloads)

moria-c

Python library for interacting with in-memory C structures using data mined from binary DWARF debug info.

nightcrawler-mitm

A python program that crawls a website and tries to stress it, polluting forms with bogus data

probeagent-ai

Offensive security testing for AI agents

rlm-toolkit

Recursive Language Models Toolkit for processing unlimited context

flask-session-cookie-manager

:cookie: Flask Session Cookie Decoder/Encoder

chimera-api

A multi-industry vulnerable attack surface with 450+ real API endpoints and 12 web apps

forbidden

Bypass 4xx HTTP response status codes and more. The tool is based on Python Requests, PycURL, and HTTP Client.

credwolf

Credential validation tool for Active Directory Domain Services.

mad-proxy

Lightweight HTTP/HTTPS interception proxy with real-time traffic firewall and domain block.