1.内置危险函数
exec
execfile
eval
2.标准库危险模块
os
subprocess
commands
3.危险第三方库
Template(user_input) : 模板注入(SSTI)所产生的代码执行
subprocess32
4.反序列化
marshal
PyYAML
pickle和cpickle
shelve
PIL
unzip
Python之数据序列化（json、pickle、shelve）
Exploiting Python PIL Module Command Execution Vulnerability
Exploiting Python Code Injection in Web Applications
EXPLOITING PYTHON CODE INJECTION IN WEB APPLICATIONS
Exploiting insecure file extraction in Python for code execution
Python Pickle的任意代码执行漏洞实践和Payload构造
Remote Code Execution on a Facebook server
Python PyYAML反序列化漏洞实验和payload构造
Exploiting Python Deserialization Vulnerabilities
Shellcoding in Python’s serialisation format
Exploiting Python Code Injection in Web Applications （翻译版）
Numpy反序列化命令执行(CVE-2019-6446)浅析
Python代码审计连载之一：CSRF 同 https://www.cdxy.me/?p=736
Python代码审计连载之二：SSTI 同 https://www.cdxy.me/?p=738
Python代码审计连载之三：Server Side Request 同 https://www.cdxy.me/?p=744
Python代码审计连载之四：Command Execution 同 https://www.cdxy.me/?p=747
Dangerous Python Functions, Part 1
Dangerous Python Functions, Part 2
Dangerous Python Functions, Part 3
来自openstack安全团队的python代码静态审计工具
来自openstack安全团队的python代码静态审计工具2
xfkxfk的python自动化代码审计 基于pyekaboo 和廖新喜的pyvulhunter
Django debug page XSS漏洞（CVE-2017-12794）分析
Django DeleteView without confirmation template, but with CSRF attack
Django CSRF Bypass (CVE-2016-7401) 漏洞分析
Django CSRF Bypass 漏洞分析(CVE-2016-7401)
Django的两个url跳转漏洞分析:CVE-2017-7233&7234
Python 格式化字符串漏洞（Django为例） 同 https://xz.aliyun.com/t/288
Django JSONField SQL注入漏洞（CVE-2019-14234）分析与影响
https://www.pytosquatting.org/
Flask Debugger页面上的通用XSS漏洞分析和挖掘过程记录
讨论PythonWeb开发中可能会遇到的安全问题之SQL注入
Django JSONField SQL注入漏洞（CVE-2019-14234）分析与影响
Python Security Auditing (II): SSTI
exploring-ssti-in-flask-jinja2
exploring-ssti-in-flask-jinja2-part-ii
https://github.com/evilcos/python-webshell
https://github.com/ahhh/Reverse_DNS_Shell
Python_Hack_知道创宇_北北(孙博).pdf
Supervisord远程命令执行漏洞（CVE-2017-11610）
Programming Secure Web Applications in Python
[CVE-2016-5699] HTTP Header Injection in Python urllib 同 http://www.anquan.us/static/drops/papers-16905.html
[CVE-2019-9740] Python urllib CRLF injection vulnerability 同 https://xz.aliyun.com/t/5123
Hack Redis via Python urllib HTTP Header Injection
struts2 S2-016/S2-017 Python GetShell
https://github.com/smartFlash/pySecurity