GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → bit4woo → Python_sec

bit4woo / Python_sec

python安全和代码审计相关资料收集 resource collection of python security and code review

Programming Languages

python
139335 projects - #7 most used programming language

Labels

securitydjangocode-review

Projects that are alternatives of or similar to Python sec

Seeker
Seeker - another job board aggregator.
Stars: ✭ 16 (-98.26%)
Mutual labels:  django
Strawberry
A new GraphQL library for Python 🍓
Stars: ✭ 891 (-3.26%)
Mutual labels:  django
Django Login Registration
Django user registration and login with form validation
Stars: ✭ 19 (-97.94%)
Mutual labels:  django
Heroku Django Template
A Django 2.0 base template featuring all recommended best practices for deployment on Heroku and local development.
Stars: ✭ 887 (-3.69%)
Mutual labels:  django
Django rest example
Django/DRF rest application example.
Stars: ✭ 17 (-98.15%)
Mutual labels:  django
Django Beginners Guide
A Complete Beginner's Guide to Django - Code Samples
Stars: ✭ 902 (-2.06%)
Mutual labels:  django
Django Rest Framework Gis
Geographic add-ons for Django REST Framework. Maintained by the OpenWISP Project.
Stars: ✭ 830 (-9.88%)
Mutual labels:  django
Docker Tutorial
Docker 基本教學 - 從無到有 Docker-Beginners-Guide 教你用 Docker 建立 Django + PostgreSQL 📝
Stars: ✭ 906 (-1.63%)
Mutual labels:  django
Django Ninja
💨 Fast, Async-ready, Openapi, type hints based framework for building APIs
Stars: ✭ 875 (-4.99%)
Mutual labels:  django
Django Photoblog
Photographer portfolio website powered by Django Framework. Features photo gallery with infinite scrolling, tagging, thumbnail generation and CMS for creating pages. Configured for Heroku and S3.
Stars: ✭ 19 (-97.94%)
Mutual labels:  django
Django Analytical
Analytics services for Django projects
Stars: ✭ 891 (-3.26%)
Mutual labels:  django
Campus42
Website that allows 42 Silicon Valley students to find each other on the map
Stars: ✭ 17 (-98.15%)
Mutual labels:  django
Django Sitecats
Django reusable application for content categorization.
Stars: ✭ 18 (-98.05%)
Mutual labels:  django
Django Oidc Rp
A server side OpenID Connect Relying Party (RP, Client) implementation for Django.
Stars: ✭ 16 (-98.26%)
Mutual labels:  django
Django2.0 Tutorial
Django2.0 Tutorial [1|2|3|4|5|6|7] Source Code
Stars: ✭ 19 (-97.94%)
Mutual labels:  django
Django Mypy
A django project to show use of mypy
Stars: ✭ 7 (-99.24%)
Mutual labels:  django
Django2.0 Course
Django2.0视频教程相关代码（杨仕航）
Stars: ✭ 897 (-2.61%)
Mutual labels:  django
Django Uwsgi Taskmanager
Django application to monitor and manage long and/or recurring tasks through uWSGI.
Stars: ✭ 22 (-97.61%)
Mutual labels:  django
Django Source
django 源码剖析
Stars: ✭ 20 (-97.83%)
Mutual labels:  django
Django Phantom Theme
Phantom is theme for django admin with many widgets, based on Twitter bootstrap 3.x.
Stars: ✭ 18 (-98.05%)
Mutual labels:  django
View All Similar Projects ➔

代码注入、命令执行

1.内置危险函数
exec
execfile
eval

2.标准库危险模块
os
subprocess
commands

3.危险第三方库
Template(user_input) : 模板注入(SSTI)所产生的代码执行
subprocess32 

4.反序列化
marshal
PyYAML
pickle和cpickle
shelve
PIL
unzip

Python沙箱逃逸的n种姿势

禁用import的情况下绕过python沙箱

Escaping the Python Sandbox

Python Sandbox Bypass

Python之数据序列化（json、pickle、shelve）

Exploiting Python PIL Module Command Execution Vulnerability

Exploiting Python Code Injection in Web Applications

EXPLOITING PYTHON CODE INJECTION IN WEB APPLICATIONS

Python eval的常见错误封装及利用原理

Exploiting Python’s Eval

Exploiting insecure file extraction in Python for code execution

掌阅iReader某站Python漏洞挖掘

Python Pickle的任意代码执行漏洞实践和Payload构造

django的secret key泄漏导致的命令执行实践

Remote Code Execution on a Facebook server

Python PyYAML反序列化漏洞实验和payload构造

Exploiting Python Deserialization Vulnerabilities

Shellcoding in Python’s serialisation format

PyCodeInjection代码注入实验环境

Exploiting Python Code Injection in Web Applications （翻译版）

Numpy反序列化命令执行(CVE-2019-6446)浅析

代码审计

Python安全编码和代码审计

Python代码审计连载之一：CSRF 同 https://www.cdxy.me/?p=736

Python代码审计连载之二：SSTI 同 https://www.cdxy.me/?p=738

Python代码审计连载之三：Server Side Request 同 https://www.cdxy.me/?p=744

Python代码审计连载之四：Command Execution 同 https://www.cdxy.me/?p=747

Dangerous Python Functions, Part 1

Dangerous Python Functions, Part 2

Dangerous Python Functions, Part 3

记一下PythonWeb代码审计应该注意的地方

廖新喜大佬的python代码审计工具

来自openstack安全团队的python代码静态审计工具

来自openstack安全团队的python代码静态审计工具2

代码审计工具pyt

xfkxfk的python自动化代码审计 基于pyekaboo 和廖新喜的pyvulhunter

Django相关

Django debug page XSS漏洞（CVE-2017-12794）分析

Django DeleteView without confirmation template, but with CSRF attack

Django安全机制

从Django的SECTET_KEY到代码执行

Django CSRF Bypass (CVE-2016-7401) 漏洞分析

Django CSRF Bypass 漏洞分析(CVE-2016-7401)

Django的两个url跳转漏洞分析:CVE-2017-7233&7234

Python 格式化字符串漏洞（Django为例） 同 https://xz.aliyun.com/t/288

Django 安全最佳实践

从Pwnhub诞生聊Django安全编码

python和django的目录遍历漏洞(任意文件读取)

新型任意文件读取漏洞的研究

django的一些安全问题答案

Django JSONField SQL注入漏洞（CVE-2019-14234）分析与影响

package钓鱼

Package 钓鱼

被忽视的攻击面：Python package 钓鱼

https://www.pytosquatting.org/

PyPI 官方仓库遭遇request恶意包投毒

LDAP注入

Python安全编码之预防LDAP注入

SSRF

谈一谈如何在Python开发中拒绝SSRF漏洞

Python安全 - 从SSRF到命令执行惨案

Splash SSRF 到获取内网服务器 ROOT 权限

XSS

Flask Debugger页面上的通用XSS漏洞分析和挖掘过程记录

SQLI

讨论PythonWeb开发中可能会遇到的安全问题之SQL注入

Django JSONField SQL注入漏洞（CVE-2019-14234）分析与影响

SSTI模版注入

Python Security Auditing (II): SSTI

exploring-ssti-in-flask-jinja2

exploring-ssti-in-flask-jinja2-part-ii

python webshell

https://github.com/evilcos/python-webshell

https://github.com/ahhh/Reverse_DNS_Shell

paper

Python_Hack_知道创宇_北北(孙博).pdf

其他

如何判断目标站点是否为Django开发

Supervisord远程命令执行漏洞（CVE-2017-11610）

python富文本XSS过滤器

基于mezzanine的攻防比赛环境搭建及XXE漏洞构造/

Python Waf黑名单过滤下的一些Bypass思路

Pwnhub Web题Classroom题解与分析

Programming Secure Web Applications in Python

[CVE-2016-5699] HTTP Header Injection in Python urllib 同 http://www.anquan.us/static/drops/papers-16905.html

[CVE-2019-9740] Python urllib CRLF injection vulnerability 同 https://xz.aliyun.com/t/5123

Hack Redis via Python urllib HTTP Header Injection

【技术分享】python web 安全总结

安全工具

python正向连接后门

struts2 S2-016/S2-017 Python GetShell

Python多线程端口扫描工具

Python JSON Fuzzer: PyJFuzz

https://github.com/smartFlash/pySecurity

对象注入、底层安全

DEFENCELY CLARIFIES PYTHON OBJECT INJECTION EXPLOITATION

OWASP Python Security Project

Escaping a Python sandbox with a memory corruption bug

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].