{"id":411,"date":"2011-06-29T21:38:50","date_gmt":"2011-06-29T21:38:50","guid":{"rendered":""},"modified":"2011-11-21T19:54:09","modified_gmt":"2011-11-21T11:54:09","slug":"411","status":"publish","type":"post","link":"http:\/\/zerobox.org\/notes\/411.html","title":{"rendered":"\u8fd0\u7528python\u6e17\u900f"},"content":{"rendered":"<div class=\"entry-content\">\n<h3>Network<\/h3>\n<ul>\n<li><a href=\"http:\/\/secdev.org\/projects\/scapy\">Scapy<\/a>: send, sniff and dissect and forge network packets. Usable interactively or as a library<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/pypcap\/\">pypcap<\/a>, <a href=\"http:\/\/oss.coresecurity.com\/projects\/pcapy.html\">Pcapy<\/a> and <a href=\"http:\/\/pylibpcap.sourceforge.net\/\">pylibpcap<\/a>: several different Python bindings for libpcap<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/libdnet\/\">libdnet<\/a>: low-level networking routines, including interface lookup and Ethernet frame transmission<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/dpkt\/\">dpkt<\/a>: fast, simple packet creation\/parsing, with definitions for the basic TCP\/IP protocols<\/li>\n<li><a href=\"http:\/\/oss.coresecurity.com\/projects\/impacket.html\">Impacket<\/a>: craft and decode network packets. Includes support for higher-level protocols such as NMB and SMB<\/li>\n<li><a href=\"http:\/\/jon.oberheide.org\/pynids\/\">pynids<\/a>: libnids wrapper offering sniffing, IP defragmentation, TCP stream reassembly and port scan detection<\/li>\n<li><a href=\"http:\/\/dirtbags.net\/py-pcap\/\">Dirtbags py-pcap<\/a>: read pcap files without libpcap<\/li>\n<li><a href=\"http:\/\/monkey.org\/~jose\/software\/flowgrep\/\">flowgrep<\/a>: grep through packet payloads using regular expressions<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/httplib2\/\">httplib2<\/a>: comprehensive HTTP client library that supports many features left out of other HTTP libraries<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/knock\/\">Knock Subdomain Scan<\/a>, enumerate subdomains on a target domain through a wordlist<\/li>\n<li><a href=\"https:\/\/bitbucket.org\/IntrepidusGroup\/mallory\">Mallory<\/a>, man-in-the-middle proxy for testing<\/li>\n<li><a href=\"http:\/\/mitmproxy.org\/\">mitmproxy<\/a>: SSL-capable, intercepting HTTP proxy. Console interface allows traffic flows to be inspected and edited on the fly<\/li>\n<\/ul>\n<h3>Debugging and reverse engineering<\/h3>\n<ul>\n<li><a href=\"http:\/\/code.google.com\/p\/paimei\">Paimei<\/a>: reverse engineering framework, includes <a href=\"http:\/\/pedram.redhive.com\/PyDbg\/\">PyDBG<\/a>, PIDA, pGRAPH<\/li>\n<li><a href=\"http:\/\/www.immunityinc.com\/products-immdbg.shtml\">Immunity Debugger<\/a>: scriptable GUI and command line debugger<\/li>\n<li><a href=\"http:\/\/d-dome.net\/idapython\/\">IDAPython<\/a>: IDA Pro plugin that integrates the Python programming language, allowing scripts to run in IDA Pro<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/pyemu\/\">PyEMU<\/a>: fully scriptable IA-32 emulator, useful for malware analysis<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/pefile\/\">pefile<\/a>: read and work with Portable Executable (aka PE) files<\/li>\n<li><a href=\"http:\/\/dkbza.org\/pydasm.html\">pydasm<\/a>: Python interface to the <a href=\"http:\/\/www.nologin.org\/main.pl?action=codeView&amp;codeId=49&amp;\">libdasm<\/a> x86 disassembling library<\/li>\n<li><a href=\"http:\/\/pydbgeng.sourceforge.net\/\">PyDbgEng<\/a>: Python wrapper for the Microsoft Windows Debugging Engine<\/li>\n<li><a href=\"http:\/\/oss.coresecurity.com\/projects\/uhooker.htm\">uhooker<\/a>: intercept calls to API calls inside DLLs, and also arbitrary addresses within the executable file in memory<\/li>\n<li><a href=\"http:\/\/www.ragestorm.net\/distorm\/\">diStorm64<\/a>: disassembler library for AMD64, licensed under the BSD license<\/li>\n<li><a href=\"http:\/\/bitbucket.org\/haypo\/python-ptrace\/wiki\/Home\">python-ptrace<\/a>: debugger using ptrace (Linux, BSD and Darwin system call to trace processes) written in Python<\/li>\n<\/ul>\n<h3>Fuzzing<\/h3>\n<p>&nbsp;<\/p>\n<ul>\n<li><a href=\"http:\/\/code.google.com\/p\/sulley\/\">Sulley<\/a>: fuzzer development and fuzz testing framework consisting of multiple extensible components<\/li>\n<li><a href=\"http:\/\/peachfuzz.sourceforge.net\/\">Peach Fuzzing Platform<\/a>: extensible fuzzing framework for generation and mutation based fuzzing<\/li>\n<li><a href=\"http:\/\/antiparser.sourceforge.net\/\">antiparser<\/a>: fuzz testing and fault injection API<\/li>\n<li><a href=\"http:\/\/theartoffuzzing.com\/\">TAOF<\/a>, including <a href=\"http:\/\/theartoffuzzing.com\/joomla\/index.php?option=com_content&amp;task=view&amp;id=21&amp;Itemid=40\">ProxyFuzz<\/a>, a man-in-the-middle non-deterministic network fuzzer<\/li>\n<li><a href=\"http:\/\/untidy.sourceforge.net\/\">untidy<\/a>: general purpose XML fuzzer<\/li>\n<li><a href=\"http:\/\/www.powerfuzzer.com\/\">Powerfuzzer<\/a>: highly automated and fully customizable web fuzzer (HTTP protocol based application fuzzer)<\/li>\n<li><a href=\"https:\/\/www.isecpartners.com\/file_fuzzers.html\">FileP<\/a>: file fuzzer. Generates mutated files from a list of source files and feeds them to an external program in batches<\/li>\n<li><a href=\"http:\/\/www.fuzzing.org\/wp-content\/SMUDGE.zip\">SMUDGE<\/a><\/li>\n<li><a href=\"http:\/\/www.packetstormsecurity.org\/fuzzer\/mistress.rar\">Mistress<\/a>: probe file formats on the fly and protocols with malformed data, based on pre-defined patterns<\/li>\n<li><a href=\"https:\/\/www.isecpartners.com\/fuzzbox.html\">Fuzzbox<\/a>: multi-codec media fuzzer<\/li>\n<li><a href=\"https:\/\/www.isecpartners.com\/forensic_fuzzing_tools.html\">Forensic Fuzzing Tools<\/a>: generate fuzzed files, fuzzed file systems, and file systems containing fuzzed files in order to test the robustness of forensics tools and examination systems<\/li>\n<li><a href=\"https:\/\/www.isecpartners.com\/windows_ipc_fuzzing_tools.html\">Windows IPC Fuzzing Tools<\/a>: tools used to fuzz applications that use Windows Interprocess Communication mechanisms<\/li>\n<li><a href=\"https:\/\/www.isecpartners.com\/wsbang.html\">WSBang<\/a>: perform automated security testing of SOAP based web services<\/li>\n<li><a href=\"http:\/\/construct.wikispaces.com\/\">Construct<\/a>: library for parsing and building of data structures (binary or textual). Define your data structures in a declarative manner<\/li>\n<li><a href=\"http:\/\/sites.google.com\/site\/felipeandresmanzano\/fuzzer.py?attredirects=0\">fuzzer.py (feliam)<\/a>: simple fuzzer by Felipe Andres Manzano<\/li>\n<li><a href=\"https:\/\/bitbucket.org\/haypo\/fusil\/wiki\/Home\">Fusil<\/a>: Python library used to write fuzzing programs<\/li>\n<\/ul>\n<h3>Web<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.isecpartners.com\/proxmon.html\">ProxMon<\/a>: processes proxy logs and reports discovered issues<\/li>\n<li><a href=\"https:\/\/www.isecpartners.com\/wsmap.html\">WSMap<\/a>: find web service endpoints and discovery files<\/li>\n<li><a href=\"http:\/\/twill.idyll.org\/\">Twill<\/a>: browse the Web from a command-line interface. Supports automated Web testing<\/li>\n<li><a href=\"http:\/\/trac.getwindmill.com\/\">Windmill<\/a>: web testing tool designed to let you painlessly automate and debug your web application<\/li>\n<li><a href=\"http:\/\/funkload.nuxeo.org\/\">FunkLoad<\/a>: functional and load web tester<\/li>\n<\/ul>\n<h3>Forensics<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.volatilesystems.com\/default\/volatility\/\">Volatility<\/a>: extract digital artifacts from volatile memory (RAM) samples<\/li>\n<li><a href=\"http:\/\/sandman.msuiche.net\/\">SandMan<\/a>: read the hibernation file, regardless of Windows version<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/libforensics\/\">LibForensics<\/a>: library for developing digital forensics applications<\/li>\n<li><a href=\"http:\/\/mark0.net\/code-tridlib-e.html\">TrIDLib<\/a>, identify file types from their binary signatures. Now includes Python binding<\/li>\n<\/ul>\n<h3>Malware analysis<\/h3>\n<ul>\n<li><a href=\"http:\/\/code.google.com\/p\/pyew\/\">pyew<\/a>: command line hexadecimal editor and disassembler, mainly to analyze malware<\/li>\n<li><a href=\"http:\/\/www.decalage.info\/exefilter\">Exefilter<\/a>: filter file formats in e-mails, web pages or files. Detects many common file formats and can remove active content<\/li>\n<li><a href=\"http:\/\/xael.org\/norman\/python\/pyclamav\/index.html\">pyClamAV<\/a>: add virus detection capabilities to your Python software<\/li>\n<li><a href=\"https:\/\/code.google.com\/p\/jsunpack-n\/\">jsunpack-n<\/a>, generic JavaScript unpacker: emulates browser functionality to detect exploits that target browser and browser plug-in vulnerabilities<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/yara-project\/source\/browse\/trunk\/yara-python\/README\">yara-python<\/a>: identify and classify malware samples<\/li>\n<\/ul>\n<h3>PDF<\/h3>\n<ul>\n<li><a href=\"http:\/\/blog.didierstevens.com\/programs\/pdf-tools\">Didier Stevens\u2019 PDF tools<\/a>: analyse, identify and create PDF files (includes <a href=\"http:\/\/blog.didierstevens.com\/programs\/pdf-tools\/#pdfid\">PDFiD<\/a>, <a href=\"http:\/\/blog.didierstevens.com\/programs\/pdf-tools\/#pdf-parser\">pdf-parser<\/a> and <a href=\"http:\/\/blog.didierstevens.com\/programs\/pdf-tools\/#make-pdf\">make-pdf<\/a> and mPDF)<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/opaf\/\">Opaf<\/a>: Open PDF Analysis Framework. Converts PDF to an XML tree that can be analyzed and modified.<\/li>\n<li><a href=\"http:\/\/www.decalage.info\/python\/origapy\">Origapy<\/a>: Python wrapper for the Origami Ruby module which sanitizes PDF files<\/li>\n<li><a href=\"http:\/\/pybrary.net\/pyPdf\/\">pyPDF<\/a>: pure Python PDF toolkit: extract info, spilt, merge, crop, encrypt, decrypt\u2026<\/li>\n<li><a href=\"http:\/\/www.unixuser.org\/~euske\/python\/pdfminer\/index.html\">PDFMiner<\/a>: extract text from PDF files<\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/python-poppler-qt4\/\">python-poppler-qt4<\/a>: Python binding for the Poppler PDF library, including Qt4 support<\/li>\n<\/ul>\n<h3>Misc<\/h3>\n<ul>\n<li><a href=\"http:\/\/oss.coresecurity.com\/projects\/inlineegg.html\">InlineEgg<\/a>: toolbox of classes for writing small assembly programs in Python<\/li>\n<li><a href=\"http:\/\/corelabs.coresecurity.com\/index.php?module=Wiki&amp;action=view&amp;type=tool&amp;name=Exomind\">Exomind<\/a>: framework for building decorated graphs and developing open-source intelligence modules and ideas, centered on social network services, search engines and instant messaging<\/li>\n<li><a href=\"http:\/\/www.securityfocus.com\/tools\/3851\">RevHosts<\/a>: enumerate virtual hosts for a given IP address<\/li>\n<li><a href=\"http:\/\/undefined.org\/python\/#simplejson\">simplejson<\/a>: JSON encoder\/decoder, e.g. to use <a href=\"http:\/\/dcortesi.com\/2008\/05\/28\/google-ajax-search-api-example-python-code\/\">Google\u2019s AJAX API<\/a><\/li>\n<li><a href=\"http:\/\/code.google.com\/p\/pymangle\/\">PyMangle<\/a>: command line tool and a python library used to create word lists for use with other penetration testing tools<\/li>\n<li><a href=\"https:\/\/bitbucket.org\/haypo\/hachoir\/wiki\/Home\">Hachoir<\/a>: view and edit a binary stream field by field<\/li>\n<\/ul>\n<h3>Other useful libraries and tools<\/h3>\n<ul>\n<li><a href=\"http:\/\/ipython.scipy.org\/\">IPython<\/a>: enhanced interactive Python shell with many features for object introspection, system shell access, and its own special command system<\/li>\n<li><a href=\"http:\/\/www.crummy.com\/software\/BeautifulSoup\/\">Beautiful Soup<\/a>: HTML parser optimized for screen-scraping<\/li>\n<li><a href=\"http:\/\/matplotlib.sourceforge.net\/\">matplotlib<\/a>: make 2D plots of arrays<\/li>\n<li><a href=\"http:\/\/code.enthought.com\/projects\/mayavi\/\">Mayavi<\/a>: 3D scientific data visualization and plotting<\/li>\n<li><a href=\"http:\/\/www.secdev.org\/projects\/rtgraph3d\/\">RTGraph3D<\/a>: create dynamic graphs in 3D<\/li>\n<li><a href=\"http:\/\/twistedmatrix.com\/\">Twisted<\/a>: event-driven networking engine<\/li>\n<li><a href=\"https:\/\/fedorahosted.org\/suds\/\">Suds<\/a>: lightweight SOAP client for consuming Web Services<\/li>\n<li><a href=\"http:\/\/chandlerproject.org\/bin\/view\/Projects\/MeTooCrypto\">M2Crypto<\/a>: most complete OpenSSL wrapper<\/li>\n<li><a href=\"http:\/\/networkx.lanl.gov\/\">NetworkX<\/a>: graph library (edges, nodes)<\/li>\n<li><a href=\"http:\/\/pyparsing.wikispaces.com\/\">pyparsing<\/a>: general parsing module<\/li>\n<li><a href=\"http:\/\/codespeak.net\/lxml\/\">lxml<\/a>: most feature-rich and easy-to-use library for working with XML and HTML in the Python language<\/li>\n<li><a href=\"http:\/\/www.noah.org\/wiki\/Pexpect\">Pexpect<\/a>: control and automate other programs, similar to Don Libes `Expect` system<\/li>\n<li><a href=\"http:\/\/groups.csail.mit.edu\/uid\/sikuli\/\">Sikuli<\/a>, visual technology to search and automate GUIs using screenshots. Scriptable in <a href=\"http:\/\/www.jython.org\/\">Jython<\/a><\/li>\n<li><a href=\"http:\/\/www.riverbankcomputing.co.uk\/software\/pyqt\">PyQt<\/a> and <a href=\"http:\/\/www.pyside.org\/\">PySide<\/a>: Python bindings for the Qt application framework and GUI library<\/li>\n<\/ul>\n<blockquote><p><strong>Source:\u00a0 <a href=\"http:\/\/www.dirk-loss.de\/python-tools.htm\">http:\/\/www.dirk-loss.de\/python-tools.htm<\/a><\/strong><\/p><\/blockquote>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Network Scapy: send, sniff and dissect a &hellip;<\/p>\n<p class=\"read-more\"><a href=\"http:\/\/zerobox.org\/notes\/411.html\">\u7ee7\u7eed\u9605\u8bfb &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[48,47],"class_list":["post-411","post","type-post","status-publish","format-standard","hentry","tag-python","tag-47"],"views":1281,"_links":{"self":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts\/411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/comments?post=411"}],"version-history":[{"count":0,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/posts\/411\/revisions"}],"wp:attachment":[{"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/media?parent=411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/categories?post=411"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/zerobox.org\/notes\/wp-json\/wp\/v2\/tags?post=411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}