Question

In the world of penetration testing with Python, it looks like
one has to generally hook into an API that’s OS specific. This makes sense
to me because we’re dealing with different architectures and kernels between
OSX, Linux, Windows. But I’m wondering if this isn’t the case?

Beyond some of the limited functionality you get out of the OS module, my assumption is that hooking into the OS’s API is general going to be specific to *POSIX flavor (maybe they have more in common) than in Windows for example.

In particular I’m thinking of Deviare on Windows. It deals with .DLL files. That’s pretty much Windows.
The moment we hear DLL, the mind goes to windows land, .plist OS X and so on.

Answer 1

Hooking is a way to get your own code to execute when another system is running, whether that other system is an OS, a GUI, or whatever. A somewhat silly example in Python:

def Process(records, per_record_hook=None):
    "adds all records to XYZ system"
    XYZ = []
    for record in records:
        if per_record_hook:
            per_record_hook(record)
        XYZ.append(record)

def print_record(record):
    "print a '.' for each record (primitive counter)"
    print '.'

and then later:

Process(records_from_somewhere, per_record_hook=print_record)