Skip to content
OPS // KITitspentest.sh

E-PYT

python

Run small scripts and stdlib helpers — JSON, HTTP, encoding — already on most hosts.

Official siteBack to catalog

OVERVIEW

Python (python.org) is the interpreter already sitting on most Linux images, macOS, and many Windows boxes as `python3`. For pentest work the value is the standard library: `json`, `http.server`, `base64`, `ssl`, `urllib` — enough to pretty-print loot, decode a blob, or stand up a short-lived file drop on an authorized listener, without pip.

Prefer `python3 -m json.tool` / `python3 -m http.server` over ad-hoc files when the stdlib module already does the job. Check `python3 --version` and whether you are in a venv before assuming modules exist. Do not `pip install` onto a client host; bring a script, or use what is already there.

USE CASES

Practical use cases

  • 01

    Pretty-printing a JSON loot file when jq is not installed.

  • 02

    Decoding base64 or URL-encoded blobs from a capture.

  • 03

    Serving a small authorized file from a scoped host for another in-scope box to fetch.

  • 04

    Running a short parser you brought, using only the stdlib.

QUICK START

When the box already has Python and you need to parse loot, decode a blob, or run a short authorized helper without adding packages.

  1. Confirm which binary is on the host (`python3 --version`) and that running it is in scope.
  2. Use a stdlib module (-m) for parse/print jobs before writing a script.
  3. Keep helpers in a working directory you will delete; do not drop them into application trees.
  4. Avoid pip and third-party packages on the client host unless the rules of engagement say otherwise.
python3 -m json.tool loot.json

BEFORE YOU RUN IT

What to check before running it

python3 -m http.server binds a cleartext listener; only use it on an isolated, in-scope path and shut it down when the transfer is done.

pip install on a client host changes that host and can pull packages from the public internet — that is usually out of scope.

Scripts you run inherit your privileges; a helper that walks the filesystem will trip the same EDR as find.

KEEP EXPLORING

View the whole phase →