9.4.5 Python Tool Environments

← Stage index | Choose tools that match your task and constraints | Strategy map | Study methods: Select and adapt public exploits

Use when: a source-based Python assessment tool has dependencies that should not modify Kali's system Python. This is setup/reference material, not authorization to install a tool.

9.4.5.1 Isolate the Python dependencies required by the reviewed tool Linux/Kali virtual environment

python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -r requirements.txt

Install one explicitly selected package only when needed:

python -m pip install PACKAGE

python -m pip show PACKAGE
python -m pip freeze
deactivate

PEP 668 intentionally protects externally managed system environments. Do not bypass it with --break-system-packages; use a venv or the distribution package when appropriate.

9.4.5.2 Run the procedure from a Windows PowerShell environment Windows PowerShell

py -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install --upgrade pip
python -m pip install -r requirements.txt
deactivate

9.4.5.3 Record the runtime and dependencies needed to repeat the procedure Reproducibility checks

python --version
python -m pip --version
python -m pip freeze > requirements-resolved.txt

Record the tool source/commit, Python version, dependency file and exact command. Keep environments per tool when their dependency ranges conflict.

9.4.5.4 uv alternative for a Python PoC with missing dependencies

Use when uv is already available and the reviewed script needs a small dependency set. Keep the baseline venv workflow as an option when uv is absent.

9.4.5.4.1 Run outside the current project's dependencies, supplying the known dependency

# Run outside the current project's dependencies, supplying the known dependency
uv run --no-project --with requests exploit.py --help

9.4.5.4.2 For a script with its own inline dependency metadata

# For a script with its own inline dependency metadata
uv run --script exploit.py --help

Read: a working help/import path establishes the local runtime only. Inspect actual arguments, authentication and target requirements before execution. Pin dependency versions when the PoC depends on an older API; an ImportError and a target-side exploit failure are different boundaries. Dependency resolution can require Internet access.

Sources: upstream 1.

9.4.5.5 Sources

getSH Useful Stuff: Python Environments, source snapshot e1f62dd
Python venv documentation
PEP 668