Quick-n-dirty Python web server

Python 3 ships with a zero-configuration HTTP server in the standard library. It serves files from the current directory (or a specified directory) over HTTP — no external dependencies, no configuration files, no daemon setup. ¹

Basic usage

python3 -m http.server $PORT

• Default port: 8000 (the raw note incorrectly states 8080; see Python docs)
• Bind address: all interfaces (0.0.0.0) by default
• Directory: current working directory by default

Useful flags

Flag	Effect
--bind ADDRESS, -b ADDRESS	Bind to a specific interface (e.g., 127.0.0.1)
--directory DIRECTORY, -d DIRECTORY	Serve a different directory
--protocol HTTP/1.1	Use HTTP/1.1 (enables keep-alive)
--cgi	Enable CGI script execution from /cgi-bin
--tls-cert FILE, --tls-key FILE	Serve over HTTPS

Security considerations

• No authentication — anyone who can reach the port can download files.
• No encryption — use --tls-cert and --tls-key for HTTPS, or tunnel over SSH.
• No request logging by default — logs go to stderr; redirect if you need persistence.
• Directory listing is enabled — an attacker can enumerate files.

Use cases

• Transferring files to/from a compromised host
• Hosting a payload for a target to download
• Catching callbacks from xss-attacks or SSRF
• Quick local development server

See also

• python
• netcat
• xss-attacks

Sources

• http.server — HTTP servers — Python 3.14.6 documentation

Footnotes

1. http.server — HTTP servers — Python 3.14.6 documentation ↩