René's URL Explorer Experiment


Title: GitHub - Johnson-xie/python_sec: python安全和代码审计相关资料收集 resource collection of python security and code review · GitHub

Open Graph Title: GitHub - Johnson-xie/python_sec: python安全和代码审计相关资料收集 resource collection of python security and code review

X Title: GitHub - Johnson-xie/python_sec: python安全和代码审计相关资料收集 resource collection of python security and code review

Description: python安全和代码审计相关资料收集 resource collection of python security and code review - Johnson-xie/python_sec

Open Graph Description: python安全和代码审计相关资料收集 resource collection of python security and code review - Johnson-xie/python_sec

X Description: python安全和代码审计相关资料收集 resource collection of python security and code review - Johnson-xie/python_sec

Opengraph URL: https://github.com/Johnson-xie/python_sec

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository
route-controllerfiles
route-actiondisambiguate
fetch-noncev2:290bbbdf-7c2f-695a-ac1d-83f0f0d93c59
current-catalog-service-hashf3abb0cc802f3d7b95fc8762b94bdcb13bf39634c40c357301c4aa1d67a256fb
request-idD3DC:1912EF:AE9BBA:E8271A:6A5B9109
html-safe-noncefcba29e6b7bc584bde66124469103ae620e8f792dd035ff592754af1628a66ae
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEM0RDOjE5MTJFRjpBRTlCQkE6RTgyNzFBOjZBNUI5MTA5IiwidmlzaXRvcl9pZCI6IjQ3MzM2NjI2MzE4NTY2NzMwMzMiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmacd31a3c50c27d5040d18f68651839d1201b5297657b841a0732136d122b3c84d3
hovercard-subject-tagrepository:175388314
github-keyboard-shortcutsrepository,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location//
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/Johnson-xie/python_sec
twitter:imagehttps://opengraph.githubassets.com/e8e2dcd37e4b5501ec53c5dde9affc7ebc5a36eef0377a0c0bcafb17358b0e72/Johnson-xie/python_sec
twitter:cardsummary_large_image
og:imagehttps://opengraph.githubassets.com/e8e2dcd37e4b5501ec53c5dde9affc7ebc5a36eef0377a0c0bcafb17358b0e72/Johnson-xie/python_sec
og:image:altpython安全和代码审计相关资料收集 resource collection of python security and code review - Johnson-xie/python_sec
og:image:width1200
og:image:height600
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None5290d7e14309ad1e76106a9c4237bd1041517e83ea182c8ab756752cb0c6940b
turbo-cache-controlno-cache
go-importgithub.com/Johnson-xie/python_sec git https://github.com/Johnson-xie/python_sec.git
octolytics-dimension-user_id40379816
octolytics-dimension-user_loginJohnson-xie
octolytics-dimension-repository_id175388314
octolytics-dimension-repository_nwoJohnson-xie/python_sec
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forktrue
octolytics-dimension-repository_parent_id106677894
octolytics-dimension-repository_parent_nwobit4woo/python_sec
octolytics-dimension-repository_network_root_id106677894
octolytics-dimension-repository_network_root_nwobit4woo/python_sec
turbo-body-classeslogged-out env-production page-responsive
disable-turbofalse
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release9c975978430e9ad293956f2bbdaf153b1bd84a99
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/Johnson-xie/python_sec#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2FJohnson-xie%2Fpython_sec
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/open-source/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/open-source/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/enterprise/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2FJohnson-xie%2Fpython_sec
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E&source=header-repo&source_repo=Johnson-xie%2Fpython_sec
Reloadhttps://github.com/Johnson-xie/python_sec
Reloadhttps://github.com/Johnson-xie/python_sec
Reloadhttps://github.com/Johnson-xie/python_sec
Johnson-xie https://github.com/Johnson-xie
python_sechttps://github.com/Johnson-xie/python_sec
bit4woo/python_sechttps://github.com/bit4woo/python_sec
Notifications https://github.com/login?return_to=%2FJohnson-xie%2Fpython_sec
Fork 0 https://github.com/login?return_to=%2FJohnson-xie%2Fpython_sec
Star 0 https://github.com/login?return_to=%2FJohnson-xie%2Fpython_sec
Code https://github.com/Johnson-xie/python_sec
Pull requests 0 https://github.com/Johnson-xie/python_sec/pulls
Actions https://github.com/Johnson-xie/python_sec/actions
Projects https://github.com/Johnson-xie/python_sec/projects
Security and quality 0 https://github.com/Johnson-xie/python_sec/security
Insights https://github.com/Johnson-xie/python_sec/pulse
Code https://github.com/Johnson-xie/python_sec
Pull requests https://github.com/Johnson-xie/python_sec/pulls
Actions https://github.com/Johnson-xie/python_sec/actions
Projects https://github.com/Johnson-xie/python_sec/projects
Security and quality https://github.com/Johnson-xie/python_sec/security
Insights https://github.com/Johnson-xie/python_sec/pulse
https://github.com/Johnson-xie/python_sec
Brancheshttps://github.com/Johnson-xie/python_sec/branches
Tagshttps://github.com/Johnson-xie/python_sec/tags
https://github.com/Johnson-xie/python_sec/branches
https://github.com/Johnson-xie/python_sec/tags
23 Commitshttps://github.com/Johnson-xie/python_sec/commits/master/
https://github.com/Johnson-xie/python_sec/commits/master/
Python_Hack_知道创宇_北北(孙博).pdfhttps://github.com/Johnson-xie/python_sec/blob/master/Python_Hack_%E7%9F%A5%E9%81%93%E5%88%9B%E5%AE%87_%E5%8C%97%E5%8C%97(%E5%AD%99%E5%8D%9A).pdf
Python_Hack_知道创宇_北北(孙博).pdfhttps://github.com/Johnson-xie/python_sec/blob/master/Python_Hack_%E7%9F%A5%E9%81%93%E5%88%9B%E5%AE%87_%E5%8C%97%E5%8C%97(%E5%AD%99%E5%8D%9A).pdf
Readme.mdhttps://github.com/Johnson-xie/python_sec/blob/master/Readme.md
Readme.mdhttps://github.com/Johnson-xie/python_sec/blob/master/Readme.md
python_audit_xfkxfk.pdfhttps://github.com/Johnson-xie/python_sec/blob/master/python_audit_xfkxfk.pdf
python_audit_xfkxfk.pdfhttps://github.com/Johnson-xie/python_sec/blob/master/python_audit_xfkxfk.pdf
READMEhttps://github.com/Johnson-xie/python_sec
https://github.com/Johnson-xie/python_sec#代码注入命令执行
Python沙箱逃逸的n种姿势https://xz.aliyun.com/t/52
禁用import的情况下绕过python沙箱https://www.anquanke.com/post/id/107000
Escaping the Python Sandboxhttps://zolmeister.com/2013/05/escaping-python-sandbox.html
Python Sandbox Bypasshttps://mp.weixin.qq.com/s?__biz=MzIzOTQ5NjUzOQ==&mid=2247483665&idx=1&sn=4b18de09738fdc5291634db1ca2dd55a
Python之数据序列化（json、pickle、shelve）http://www.cnblogs.com/yyds/p/6563608.html
Exploiting Python PIL Module Command Execution Vulnerabilityhttps://xz.aliyun.com/t/44
Exploiting Python Code Injection in Web Applicationshttps://www.doyler.net/security-not-included/exploiting-python-code-injection
EXPLOITING PYTHON CODE INJECTION IN WEB APPLICATIONShttp://www.securitynewspaper.com/2016/11/12/exploiting-python-code-injection-web-applications/
Python eval的常见错误封装及利用原理http://xxlegend.com/2015/07/31/Python%20eval%E7%9A%84%E5%B8%B8%E8%A7%81%E9%94%99%E8%AF%AF%E5%B0%81%E8%A3%85%E5%8F%8A%E5%88%A9%E7%94%A8%E5%8E%9F%E7%90%86/
Exploiting Python’s Evalhttp://www.floyd.ch/?p=584
Exploiting insecure file extraction in Python for code executionhttps://ajinabraham.com/blog/exploiting-insecure-file-extraction-in-python-for-code-execution
掌阅iReader某站Python漏洞挖掘https://www.leavesongs.com/PENETRATION/zhangyue-python-web-code-execute.html
Python Pickle的任意代码执行漏洞实践和Payload构造http://code2sec.com/python-picklede-ren-yi-dai-ma-zhi-xing-lou-dong-shi-jian-he-payloadgou-zao.html
django的secret key泄漏导致的命令执行实践http://code2sec.com/djangode-secret-keyxie-lou-dao-zhi-de-ming-ling-zhi-xing-shi-jian.html
Remote Code Execution on a Facebook serverhttps://blog.scrt.ch/2018/08/24/remote-code-execution-on-a-facebook-server/
Python PyYAML反序列化漏洞实验和payload构造http://www.code2sec.com/2017/09/22/python-pyyaml%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%E5%AE%9E%E9%AA%8C%E5%92%8Cpayload%E6%9E%84%E9%80%A0/
Exploiting Python Deserialization Vulnerabilitieshttps://crowdshield.com/blog.php?name=exploiting-python-deserialization-vulnerabilities
Shellcoding in Python’s serialisation formathttps://media.blackhat.com/bh-us-11/Slaviero/BH_US_11_Slaviero_Sour_Pickles_WP.pdf
PyCodeInjection代码注入实验环境https://github.com/sethsec/PyCodeInjection
Exploiting Python Code Injection in Web Applicationshttps://sethsec.blogspot.com/2016/11/exploiting-python-code-injection-in-web.html
翻译版https://www.anquanke.com/post/id/84891
https://github.com/Johnson-xie/python_sec#代码审计
Python安全编码和代码审计http://xxlegend.com/2015/07/30/Python%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E5%92%8C%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/
Python代码审计连载之一：CSRFhttps://xz.aliyun.com/t/391
https://www.cdxy.me/?p=736https://www.cdxy.me/?p=736
Python代码审计连载之二：SSTIhttps://xz.aliyun.com/t/390
https://www.cdxy.me/?p=738https://www.cdxy.me/?p=738
Python代码审计连载之三：Server Side Requesthttps://xz.aliyun.com/t/389
https://www.cdxy.me/?p=744https://www.cdxy.me/?p=744
Python代码审计连载之四：Command Executionhttps://xz.aliyun.com/t/388
https://www.cdxy.me/?p=747https://www.cdxy.me/?p=747
Dangerous Python Functions, Part 1https://www.kevinlondon.com/2015/07/26/dangerous-python-functions.html
Dangerous Python Functions, Part 2https://www.kevinlondon.com/2015/08/15/dangerous-python-functions-pt2.html
Dangerous Python Functions, Part 3https://www.kevinlondon.com/2017/01/30/dangerous-python-functions-pt3.html
记一下PythonWeb代码审计应该注意的地方http://blog.neargle.com/2016/07/25/log-of-simple-code-review-about-python-base-webapp/
廖新喜大佬的python代码审计工具https://github.com/shengqi158/pyvulhunter
来自openstack安全团队的python代码静态审计工具https://github.com/openstack/bandit
来自openstack安全团队的python代码静态审计工具2https://github.com/openstack/syntribos
代码审计工具pythttps://github.com/python-security/pyt
xfkxfk的python自动化代码审计https://mp.weixin.qq.com/s?__biz=MzUxOTYzMzU0NQ==&mid=2247483887&idx=1&sn=99ab12309de75381e37c058d53def1b6&chksm=f9f7ee09ce80671fc5887a9c25350fc610559cc1e095f9b689473873889581e4c5fbb0dec2cd&mpshare=1&
pyekaboohttps://github.com/SafeBreach-Labs/pyekaboo
pyvulhunterhttps://github.com/shengqi158/pyvulhunter
https://github.com/Johnson-xie/python_sec#django相关
Django debug page XSS漏洞（CVE-2017-12794）分析https://www.leavesongs.com/PENETRATION/django-debug-page-xss.html
Django DeleteView without confirmation template, but with CSRF attackhttps://www.leavesongs.com/PYTHON/django-deleteView-without-confirmation-template.html
Django安全机制http://xxlegend.com/2015/04/01/Django%E5%AE%89%E5%85%A8%E6%9C%BA%E5%88%B6/
从Django的SECTET_KEY到代码执行http://xxlegend.com/2015/04/01/%E4%BB%8EDjango%E7%9A%84SECTET_KEY%E5%88%B0%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/
Django CSRF Bypass (CVE-2016-7401) 漏洞分析https://paper.seebug.org/58/
Django CSRF Bypass 漏洞分析(CVE-2016-7401)http://blog.knownsec.com/2016/10/django-csrf-bypass_cve-2016-7401/
Django的两个url跳转漏洞分析:CVE-2017-7233&7234https://paper.seebug.org/274/
Python 格式化字符串漏洞（Django为例）https://www.leavesongs.com/PENETRATION/python-string-format-vulnerability.html
https://xz.aliyun.com/t/288https://xz.aliyun.com/t/288
Django 安全最佳实践http://www.atjiang.com/2scoopsdjango1.8-26-security-best-practices/
从Pwnhub诞生聊Django安全编码https://www.leavesongs.com/PYTHON/django-coding-experience-from-pwnhub.html
python和django的目录遍历漏洞(任意文件读取)http://www.lijiejie.com/python-django-directory-traversal/
新型任意文件读取漏洞的研究https://www.leavesongs.com/PENETRATION/arbitrary-files-read-via-static-requests.html
django的一些安全问题答案https://www.kevinlondon.com/2015/10/16/answers-to-django-security-questions.html
https://github.com/Johnson-xie/python_sec#package钓鱼
Package 钓鱼https://paper.seebug.org/311/
被忽视的攻击面：Python package 钓鱼https://paper.seebug.org/326/
https://www.pytosquatting.org/https://www.pytosquatting.org/
https://github.com/Johnson-xie/python_sec#ldap注入
Python安全编码之预防LDAP注入http://xxlegend.com/2016/12/01/Python%E5%AE%89%E5%85%A8%E7%BC%96%E7%A0%81%E4%B9%8B%E9%A2%84%E9%98%B2LDAP%E6%B3%A8%E5%85%A5/
https://github.com/Johnson-xie/python_sec#ssrf
谈一谈如何在Python开发中拒绝SSRF漏洞https://www.leavesongs.com/PYTHON/defend-ssrf-vulnerable-in-python.html
Python安全 - 从SSRF到命令执行惨案https://www.leavesongs.com/PENETRATION/getshell-via-ssrf-and-redis.html
Splash SSRF 到获取内网服务器 ROOT 权限https://xz.aliyun.com/t/118
https://github.com/Johnson-xie/python_sec#xss
Flask Debugger页面上的通用XSS漏洞分析和挖掘过程记录http://blog.neargle.com/2016/09/21/flask-src-review-get-a-xss-from-debuger/
https://github.com/Johnson-xie/python_sec#sqli
讨论PythonWeb开发中可能会遇到的安全问题之SQL注入http://blog.neargle.com/2016/07/22/pythonweb-framework-dev-vulnerable/
https://github.com/Johnson-xie/python_sec#ssti模版注入
Python Security Auditing (II): SSTIhttps://www.cdxy.me/?p=738
exploring-ssti-in-flask-jinja2https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2/
exploring-ssti-in-flask-jinja2-part-iihttps://nvisium.com/blog/2016/03/11/exploring-ssti-in-flask-jinja2-part-ii/
https://github.com/Johnson-xie/python_sec#python-webshell
https://github.com/evilcos/python-webshellhttps://github.com/evilcos/python-webshell
https://github.com/ahhh/Reverse_DNS_Shellhttps://github.com/ahhh/Reverse_DNS_Shell
https://github.com/Johnson-xie/python_sec#paper
https://github.com/Johnson-xie/python_sec#其他
如何判断目标站点是否为Django开发https://www.leavesongs.com/PENETRATION/detect-django.html
Supervisord远程命令执行漏洞（CVE-2017-11610）https://www.leavesongs.com/PENETRATION/supervisord-RCE-CVE-2017-11610.html
python富文本XSS过滤器https://www.leavesongs.com/PYTHON/python-xss-filter.html
基于mezzanine的攻防比赛环境搭建及XXE漏洞构造/http://xxlegend.com/2016/04/01/%E5%9F%BA%E4%BA%8Emezzanine%E7%9A%84%E6%94%BB%E9%98%B2%E6%AF%94%E8%B5%9B%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA%E5%8F%8AXXE%E6%BC%8F%E6%B4%9E%E6%9E%84%E9%80%A0/
Python Waf黑名单过滤下的一些Bypass思路http://www.0aa.me/index.php/archives/123/
Pwnhub Web题Classroom题解与分析https://www.leavesongs.com/PENETRATION/pwnhub-web-classroom-django-sql-injection.html
Programming Secure Web Applications in Pythonhttps://www.thoughtco.com/programming-secure-web-applications-2813531
Advisory: HTTP Header Injection in Python urllibhttp://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
Hack Redis via Python urllib HTTP Header Injectionhttps://security.tencent.com/index.php/blog/msg/106
【技术分享】python web 安全总结http://bobao.360.cn/learning/detail/4522.html
https://github.com/Johnson-xie/python_sec#安全工具
python正向连接后门https://www.leavesongs.com/PYTHON/python-shell-backdoor.html
struts2 S2-016/S2-017 Python GetShellhttps://www.leavesongs.com/PENETRATION/UseOfStruts.html
Python多线程端口扫描工具https://www.leavesongs.com/PYTHON/PortScanner.html
Python JSON Fuzzer: PyJFuzzhttps://n0where.net/python-json-fuzzer-pyjfuzz/
https://github.com/smartFlash/pySecurityhttps://github.com/smartFlash/pySecurity
https://github.com/Johnson-xie/python_sec#对象注入底层安全
DEFENCELY CLARIFIES PYTHON OBJECT INJECTION EXPLOITATIONhttps://defencely.com/blog/defencely-clarifies-python-object-injection-exploitation/
OWASP Python Security Projecthttps://github.com/ebranca/owasp-pysec
Escaping a Python sandbox with a memory corruption bughttps://hackernoon.com/python-sandbox-escape-via-a-memory-corruption-bug-19dde4d5fea5
Readme https://github.com/Johnson-xie/python_sec#readme-ov-file
Please reload this pagehttps://github.com/Johnson-xie/python_sec
Activityhttps://github.com/Johnson-xie/python_sec/activity
0 forkshttps://github.com/Johnson-xie/python_sec/forks
Report repository https://github.com/contact/report-content?content_url=https%3A%2F%2Fgithub.com%2FJohnson-xie%2Fpython_sec&report=Johnson-xie+%28user%29
Releaseshttps://github.com/Johnson-xie/python_sec/releases
Packages 0https://github.com/users/Johnson-xie/packages?repo_name=python_sec
Please reload this pagehttps://github.com/Johnson-xie/python_sec
Contributorshttps://github.com/Johnson-xie/python_sec/graphs/contributors
Please reload this pagehttps://github.com/Johnson-xie/python_sec
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.