First steps in Python for security
You write from scratch the small scripts a security team writes every day: scanning files, hashing, running commands and simple checks.
Level 101 · 16 lessons · 18 practice labs
Lessons
The world of scripts
- Why security teams use Python
- Virtual environments and installing packages safely
- A script you run from the terminal: arguments and exit codes
- Short task: write a small audit script that introduces itself
Working with files
- Walking the directory tree with pathlib
- Finding world-writable files
- File hashes with hashlib: MD5, SHA-256
- Building a hash baseline and catching changed files
- Short task: find the tampered file in a folder
Talking to the system
- Running commands with subprocess and avoiding shell injection
- Reading users, processes and listening ports
- Regular expressions for security: IPs, emails, URLs
- Searching files for forgotten passwords and keys
- Short task: report the exposed keys in a project folder
Wrap-up
- Readable output: tables, colour and JSON
- Capstone: a one-command health and security check for a server
Practice labs
- Add exit codes to an audit script: Fix the given disk-usage script so it returns 2 when the threshold is exceeded and 0 otherwise, and show both cases with $?.
- A log filter with argparse: Write a log filter for Kuzey Logistics that takes --since, --level and --json, and show it exits with a clear message on bad arguments.
- A tool that fails in a broken virtual environment: Repair the virtual environment, unpinned package versions and wrong shebang of an audit tool that fails on another machine, then prove it runs with one command in a clean environment.
- Find the changed configuration file: Write a script that compares the given SHA-256 list with the folder, and report the single modified file on the Piril Bakery server by name.
- Added, removed and changed files: Compare two hash lists taken two days apart and produce the added, removed and changed files as JSON under three separate keys.
- The timestamp is lying: Write an integrity script that also catches files whose modification time was reset, and show the file the old mtime-only script missed.
- World-writable files: Write a pathlib script that finds world-writable files and folders in the given web directory and prints them with their permission bits.
- A fix plan for risky permissions: Find world-writable, ownerless and SUID files in the Atlas Clinic share folder and produce a report with a suggested chmod/chown command for each.
- When did the permissions loosen?: Write a script that records file modes, owners and SUID bits, compare with the record from a week ago and report the files on the Karaçam Mobilya share whose permissions loosened, with old and new modes.
- A forgotten API key in a project: Find lines containing API keys and passwords in the given project folder with regular expressions, and report file name and line number with the value masked.
- False alarms in a secret scan: Fix a secret scanner that flags sample values and test data by adding an allowlist, and show the two real leaks are still caught.
- Catch the keys that match no pattern: Add a randomness measure to your secret scanner so it also finds keys that match no known pattern, skip binary and very large files safely, and report findings showing only the first four characters of each value.
- Run a command and capture its output and result: Write a small script that runs disk and service status commands with subprocess using argument lists, captures output and return code, and reports a failed command separately.
- A hung command must not freeze the script: Add a timeout, error-output capture and a missing-command check to an audit script that waits forever on an unresponsive command, and show it carries on with a clear line in all three failure cases.
- A script open to shell injection: Rewrite a backup script that runs a user-supplied file name with shell=True to use an argument list, and show a malicious file name can no longer run commands.
- List the accounts that can log in: Write a script that reads the user file and lists, under separate headings, the accounts with a login shell, those with user id zero and those whose home directory is missing.
- Listening ports that are not on the allowed list: Write a script that collects listening ports and the processes that opened them, compare with the Ayçiçeği Gıda server’s allowed list and output the ports not on the list with their process names as JSON.
- A one-command server report card: Write a script that gathers users, listening ports, risky permissions and disk state of the Blue Harbour Cargo server into one JSON report, and order the findings by severity.
About this course
You write from scratch the small scripts a security team writes every day: scanning files, hashing, running commands and simple checks.
What you will learn
- The world of scripts
- Working with files
- Talking to the system
- Wrap-up
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.