Python for security practice
You solve short tasks from a real security team’s day in Python: each one starts from a file, a log or a service.
Level 201 · 16 lessons · 15 practice labs
Lessons
Files and text
- Decode a message with nested encodings
- Find copies of the same file by hash
- Find who visited a blocked site in a proxy log
- Short task: find and report old key files
Network and services
- Tabulate which host answers on which port
- Build a certificate inventory of internal sites
- Find the mismatch between DNS and the inventory
- Short task: list the services running outdated versions
Incidents and detection
- Find the moment the attacker IP was first seen
- Find a script added later to the web root
- Find the scheduled task added between two backups
- Short task: turn a day of alerts into a manager summary
Wrap-up
- Find the real sender from a phishing email’s headers
- Safely search a leaked password list for company accounts
- Speed round: five small tasks, one script
- Capstone: solve an incident folder through chained tasks
Practice labs
- A note in nested encodings: Write a script that unwraps a message layered in Base64, hex and URL encoding by detecting each layer automatically, and show the plain text.
- Copies of the same file: Write a fast script that finds files with identical content but different names among thousands in the Orchid Hotel share, checking size first and then hash.
- Who visited the blocked site: Join the proxy log, DHCP leases and user session records to find, with evidence, which user held the address that visited the blocked site at that moment.
- Which host answers on which port: Write a script that tries the given port list on the hosts of your own lab network and prints the result as a host-port table.
- A certificate inventory of internal sites: Write a script that collects the certificates of the lab’s internal sites and writes subject, issuer, expiry and whether self-signed to a CSV inventory.
- Services running outdated versions: Collect versions of the mixed services in the lab network from banners and protocol replies, identify the one with a hidden banner from another clue, and list those needing an update.
- When was the attacker address first seen: Write a script that finds the first and last time the given address appears across several log files and what it did at that moment.
- A script added later to the web root: Compare the web root with the hashes in the deployment manifest to find added and modified files, and show the first request for that file in the access log.
- A task added between two backups: Write a tool that compares two backup archives without unpacking them and finds the scheduled task added in between, the script it runs and the address that script contacts.
- The real sender of a phishing email: Parse the Received chain and authentication results of the given email file, and report the difference between the displayed sender and the real sending server.
- Company accounts in a leak list: Search the lab-generated leak list for Saltmarsh Fisheries accounts without writing passwords to screen or disk in plain text, and report only the affected account names.
- An incident folder with chained clues: Solve an incident folder where each step’s output unlocks the next: decode the note, find the address in the log it points to, and report the hash of the file that address downloaded.
- Key files more than a year old: Write a script that finds private key files in home directories that are more than a year old or have loose permissions, and report them as a table with owner, age and mode.
- A one-page summary from a day of alerts: Group Turnalı Perakende’s one-day alert file by type, severity and affected system and produce a jargon-free summary with the three most important topics, the change from yesterday and the items still open.
- Five small jobs, one script: Gather the five small jobs in the handover folder (decode the encoded note, find duplicate files, extract the address with the most errors in a log, list certificates about to expire, summarise the results) into one script with subcommands and give all results in a single JSON report.
About this course
You solve short tasks from a real security team’s day in Python: each one starts from a file, a log or a service.
What you will learn
- Files and text
- Network and services
- Incidents and detection
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.