pwntools
4.15.0 open-sourceThe section your link pointed to isn't on pwntools's page any more, so we've brought you to the top.
CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. framework and exploit development library for rapid prototyping and writing exploits in Python.
from pwn import *
context.gdb_binary = 'pwndbg'
dbg = gdb.debug('./target')
io.upload_manually('exploit.py', '/tmp/exploit.py')
context.cache_dir = None
print(asm('nop'))
import pwn
pwn.gdb.debug('target.exe', gdb_args=['-q'], port=9000)
import pwn
pwn.libcdb.search_by_hash('hash_value', offline=True)
$ pwn template --binary ./challenge.elf
pwn template --libc /lib/x86_64-linux-gnu/libc.so.6 --args ./target
pwn hex -p 0x -s , 'AABB'
cp my_template.py ~/.config/pwn/templates/my_template.py
from pwnlib.util.fiddling import js_escape
js_escape('<script>alert(1)</script>')
from pwn import *; print(shellcraft.linux.cat2())
source <(pwn completion zsh) # for zsh
source <(pwn completion bash) # for bash
from pwn import gdb
api = gdb.gdbapi
# Use api for GDB commands
from pwn import context
context.os = 'baremetal'
# Proceed with debugging
export XDG_CONFIG_HOME=$HOME/.config
# pwntools will now look for pwn.conf in $XDG_CONFIG_HOME
pwn version
rop = ELF('binary').rop()
gadget = rop.jmp_esp # x86
gadget = rop.jmp_rsp # x64
elf = ELF('binary')
result = elf.search(b'\xff\xe4', executable=True)
qemu.launch(sysroot='/path/to/sysroot')
from pwnlib.adb.bootimg import BootImage
bi = BootImage(open('boot.img').read())
print(bi.kernel_size)
from pwnlib import shellcraft
print(shellcraft.dupio('mips'))
from pwnlib import context
context.encoding = 'utf-8'
pwn debug <binary_name>
pwn template my_exploit.py --remote example.com 1337
p = ssh.connect('host')
print(p.checksec())
p = process('./vuln')
core = p.corefile
print(core.read(0x41414141, 4))
ssh.process(host='target', user='root', shell='/bin/sh')
from pwn import *
context.buffer_size = 1024
r = remote('localhost', 9999, buffer_fill_size=512)
from pwn import adb
adb.isdir('/data/local/tmp')
from pwn import *
context.device = 'emulator-5554'
context.adb_host = 'localhost'
context.adb_port = 5037
from pwn import *
code = asm('''
mov eax, 1
xor edi, edi
int 0x80
''')
ep = asm.make_elf(code)
from pwn import *
de = DynELF(elf, read=leak_func)
stack_addr = de.stack
pwntools asm --debug shellcraft.i386.linux.cat /etc/passwd
Summary
pwntools is an open-source CTF framework and exploit development library, free under the MIT license. It's a Python library imported into scripts rather than a standalone application, though it also ships CLI utilities like a libc database fetcher used when building exploits offline. It's aimed at CTF players and exploit developers who want to prototype shellcode, craft payloads, and script interaction with remote services without hand-rolling socket and packing code. Its README frames it as a CTF toolkit rather than positioning itself against a named competitor, so it sits in the broader exploit-development category alongside other scripting aids used in binary exploitation. First committed in 2012, it remains active with 335 contributors and 111 commits in the past year, though its most recent release was 313 days ago.
CTF framework and exploit development library for rapid prototyping and writing exploits in Python.
How pwntools helps
How do I get shellcode running on a remote service without hand-rolling socket and packing code?
opens a connection with one call and hands back an object that assembles and sends shellcode for the target architecture, then drops into an interactive session for the rest of the exchange
Which bytes am I actually sending when I pack this value for the target binary?
packing and assembly routines take an explicit architecture and OS context and produce the exact byte string, so mismatches between what was intended and what was sent become visible before the payload reaches the wire
What libc is this binary linked against, and where do I get one to build an offline exploit?
a bundled command line utility fetches and searches a database of known libc builds so offsets can be resolved without hitting the network at exploit time
Will my exploit script behave the same on this binary as it did on the last one?
setting the architecture and operating system once in a shared context makes every subsequent packing, assembly, and shellcode call use those same assumptions, so switching targets is a one-line change instead of a rewrite
Is the payload I built actually shellcode, or did an offset shift break it?
shellcode-generation helpers produce ready-to-send byte sequences for common tasks like spawning a shell, so the output can be diffed or tested directly against a target rather than assembled by hand
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for pwntools, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail pwntools puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
24 entries
No entries match these filters.
- October 20251
- January 20251
- August 20241
- February 20241
- September 20231
- May 20231
- December 20221
- November 20211
- July 20211
- April 20211
- March 20211
- November 20201
- May 20201
- January 20201
- February 20181
- January 20181
- October 20171
- July 20171
- May 20171
- March 20171
- February 20171
- December 20161
- November 20161
- August 20161
Project health
Issue, contributor and maintainer activity in Gallopsled/pwntools, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 38 +6 vs prior 12 months
- Maintainers 2 +0 joined · −1 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed 74% of issues opened, last 12 months
- Median time to close 184 days first maintainer reply 10 days
- Open backlog 92 of 1,134 issues ever filed
- Issues opened / month 1 · 1 communitymaintainers
- Open backlog 92
- Contributors / month 1
- Commits / month 1
- Stars 13,710
- bugs 44%
- features 29%
- questions 9%
- other 18%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Libraries its release ships
What its latest release locks, checked against known advisories.None of its release's images build from a lockfile we can read.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →