Build your own defence tools (Python)
Inventory, service and HTTP checks, configuration audits and log-alert tools.
Level 301 · 19 lessons · 15 practice labs
Lessons
Tool design
- Designing a security tool and its command line in Python: You will learn to plan a small security tool and give it a handy command-line interface in Python.
- Keeping tool settings and secrets out of the code
- Structured logging in Python: You will turn your tools' output into structured logs that machines can read easily, making searching and alerting simpler.
- Short task: set up a tool skeleton with subcommands
Network and service checks
- An inventory tool for your own network in Python: You will write an inventory tool that finds the devices and services on your own network and puts them into a tidy list.
- Service checks, timeouts and error handling in Python: You will write code that checks whether a service is up and in the expected state, and handle timeouts and errors properly.
- Concurrency in Python: speeding things up with threads: You will run many checks at once with threads to speed up your tool, and learn the points to be careful about.
- Building and reading packets with Scapy: You will build and send packets in your own lab network with Scapy, read the replies field by field and write small network tests.
- Short task: catch the port that opened since yesterday
Web and configuration audits
- An HTTP endpoint checker in Python: You will write a tool that checks the response code, speed and security headers of web endpoints.
- A Python tool that audits exposed paths on your own web server: You will write a Python tool that gently checks word-list paths on your own server and reports what is exposed.
- A configuration audit tool in Python: You will write an audit tool that compares configuration files with safe settings and reports any differences.
- Checking certificate expiry dates and weak settings
- Short task: rank the audit findings by severity
Alerts, packaging and wrap-up
- A log-based alerting tool in Python: You will write a simple tool that watches log files and raises an alert when it sees the patterns you define.
- Delivering alerts by webhook and email
- Testing a security tool with pytest
- Packaging the tool: pyproject and one-command install
- Capstone: combine the audit tools into one Python tool: In the capstone you will combine inventory, service, configuration and log checks into one working tool for a fictional company.
Practice labs
- A tool skeleton with subcommands: Set up a tool skeleton with scan, audit and report subcommands, each with a clear --help, and show all three can be called.
- Move the password out of the code: Move the webhook URL and API password from the source into an environment variable and a permission-restricted config file, and show the tool stops clearly when a setting is missing.
- From scattered prints to structured logs: Add levelled JSON logging to an old audit tool full of print calls, and show secrets never reach the log while debug mode gives detail.
- The port that opened since yesterday: Write a script that compares yesterday’s and today’s scan results and lists newly opened and closed ports per host.
- An inventory sped up with threads: Speed up the slow sequential inventory tool for the Caravan Travel lab network with a thread pool, and show the time difference by measurement.
- The shared results list gets corrupted: Find and fix the race condition in an inventory tool that loses or duplicates hosts when run concurrently, and show ten consecutive runs give the same result.
- Exposed paths: Write a checker that probes your own lab web server for paths that should not be exposed, such as .git, backup files and admin pages, and report findings with status codes.
- Certificates about to expire: Write an audit that reads the certificates of internal lab sites and flags those expiring within thirty days, those with weak keys and those with name mismatches.
- Configuration findings ranked by severity: Write a tool that audits Copperleaf Insurance’s SSH and web server configs against rules, ranks findings by severity and raises no false alarms.
- Alert when a threshold is crossed: Write a watcher that produces an alert line when failed logins exceed a set number in five minutes, and show it triggers on the given log.
- Webhook alerts get lost: Fix a tool that loses alerts when the lab webhook receiver returns transient errors by adding retries and a queue, and show pending alerts are delivered when it recovers.
- Tame an alert storm: Fix a tool that sends hundreds of alerts for one incident by adding grouping and a quiet period, and show a genuinely new incident is still reported at once.
- pytest tests for a parser: Write pytest tests for a log parser function covering normal, broken and empty lines, and show they all pass.
- Tests that run without a network: Rewrite the tests for a network-bound service checker using fake sockets and fake HTTP responses, and show they pass with the network off.
- A tool that installs with one command: Package an audit tool made of scattered scripts with pyproject, define a command-line entry point, and show it installs with pip and runs in a clean virtual environment.
About this course
Inventory, service and HTTP checks, configuration audits and log-alert tools.
What you will learn
- Tool design
- Network and service checks
- Web and configuration audits
- Alerts, packaging and wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.