Skip to content

Pip-Package-Manager.md

Latest commit

 

History

History
114 lines (84 loc) · 4.49 KB

Pip-Package-Manager.md

File metadata and controls

114 lines (84 loc) · 4.49 KB
Raw

Pip Package Manager

Using pip and pipx to install, upgrade, freeze, and pin Python packages, and managing dependencies with requirements.txt.

Overview

pip is Python's package installer, pulling libraries from the Python Package Index (PyPI). For security tooling you use it to install libraries like requests, scapy, and impacket into a [[Managing-Virtual-Environments|virtual environment]], and to record exact versions in requirements.txt for reproducibility. pipx complements pip by installing standalone CLI tools (e.g. impacket, crackmapexec) into their own isolated environments so they never conflict with project dependencies.

Syntax

python -m pip install requests           # install (use the venv's pip)
python -m pip install "requests==2.31.0" # pin an exact version
python -m pip install --upgrade requests # upgrade
python -m pip uninstall requests         # remove
python -m pip freeze > requirements.txt  # snapshot exact versions
python -m pip install -r requirements.txt

Explanation

Prefer python -m pip over a bare pip so you always use the pip belonging to the active interpreter.

Command Purpose
pip install pkg Install latest compatible version
pip install "pkg==1.2.3" Install an exact pinned version
pip install -r requirements.txt Install a full dependency set
pip freeze List installed packages with exact versions
pip list --outdated Show upgradable packages
pip show pkg Display metadata (version, location, deps)

requirements.txt records the dependency set. Pin exact versions (==) for reproducible engagements; use ranges only when you deliberately want updates.

# requirements.txt — pinned for reproducibility
requests==2.31.0
scapy==2.5.0
impacket==0.11.0

pipx installs Python applications in isolated venvs and exposes their commands on PATH:

python3 -m pip install --user pipx
pipx install impacket
pipx list
pipx upgrade-all

Warning

Installing from PyPI runs arbitrary maintainer code. Typosquatting and malicious packages are real (e.g. names close to requests/urllib3). Verify the package name, pin versions, and prefer a hash-checked lock for anything you run on sensitive hosts.

Examples

# Reproduce a toolchain from a saved requirements file
python3 -m venv .venv && source .venv/bin/activate
python -m pip install -r requirements.txt
python -m pip list

Output

Package   Version
--------- -------
impacket  0.11.0
requests  2.31.0
scapy     2.5.0

Security Use Cases

  • Pinning every dependency in requirements.txt so a scan or exploit runs identically on a retest or in CI.
  • Using pipx to keep offensive CLI tools (impacket, crackmapexec) isolated from each other and from project venvs.
  • Auditing a target's requirements.txt/pip list for outdated packages with known CVEs (pip-audit).

Best Practices

  • Always install inside an activated venv; never sudo pip install.
  • Pin exact versions in requirements.txt for engagement reproducibility; separate requirements-dev.txt for tooling like linters.
  • Run pip-audit to flag dependencies with known vulnerabilities.
  • Use --no-cache-dir in Docker images to keep them small and free of stale wheels.

Common Mistakes

  • Running pip install with no venv active and polluting the system interpreter.
  • Committing an unpinned requirements.txt (requests with no version), so rebuilds silently pull a different release.
  • Blindly pip install-ing a mistyped package name and executing a typosquatted malicious package.
  • Mixing sudo pip and user pip, ending up with duplicate/broken installs.

Practical Lab

Goal: build, freeze, and rebuild a reproducible toolchain.

  1. In a fresh venv, python -m pip install requests scapy.
  2. python -m pip freeze > requirements.txt and inspect the pinned versions.
  3. Delete the venv, recreate it, and python -m pip install -r requirements.txt.
  4. python -m pip install pipx (user), then pipx install impacket and confirm the command is on PATH.

References

Related

  • [[Managing-Virtual-Environments]]
  • [[Project-Structure-Best-Practices]]
  • [[Pyenv]]
  • [[Python-Environment-Setup/Readme|Python Environment Setup]] — module index
  • [[Readme|Python for Security Professionals]] — course home