E-PYT
python
Run small scripts and stdlib helpers — JSON, HTTP, encoding — already on most hosts.
OVERVIEW
Python (python.org) is the interpreter already sitting on most Linux images, macOS, and many Windows boxes as `python3`. For pentest work the value is the standard library: `json`, `http.server`, `base64`, `ssl`, `urllib` — enough to pretty-print loot, decode a blob, or stand up a short-lived file drop on an authorized listener, without pip.
Prefer `python3 -m json.tool` / `python3 -m http.server` over ad-hoc files when the stdlib module already does the job. Check `python3 --version` and whether you are in a venv before assuming modules exist. Do not `pip install` onto a client host; bring a script, or use what is already there.
USE CASES
Practical use cases
- 01
Pretty-printing a JSON loot file when jq is not installed.
- 02
Decoding base64 or URL-encoded blobs from a capture.
- 03
Serving a small authorized file from a scoped host for another in-scope box to fetch.
- 04
Running a short parser you brought, using only the stdlib.
QUICK START
When the box already has Python and you need to parse loot, decode a blob, or run a short authorized helper without adding packages.
- Confirm which binary is on the host (`python3 --version`) and that running it is in scope.
- Use a stdlib module (-m) for parse/print jobs before writing a script.
- Keep helpers in a working directory you will delete; do not drop them into application trees.
- Avoid pip and third-party packages on the client host unless the rules of engagement say otherwise.
python3 -m json.tool loot.jsonBEFORE YOU RUN IT
What to check before running it
python3 -m http.server binds a cleartext listener; only use it on an isolated, in-scope path and shut it down when the transfer is done.
pip install on a client host changes that host and can pull packages from the public internet — that is usually out of scope.
Scripts you run inherit your privileges; a helper that walks the filesystem will trip the same EDR as find.