Python for security operations: sockets and requests
Log parsing, scanning and automation scripts.
Level 201 · 17 lessons · 15 practice labs
Lessons
Looking at the network with Python
- Python socket basics: a TCP connection: You will understand the basic idea of using a socket in Python to make a TCP connection to a service in your own lab.
- Reading a service banner and closing the socket in Python: You will learn to read in Python the banner line a service uses to introduce itself, and to close the socket properly when finished.
- Handling timeouts and connection errors
- Short task: verify open services on a list of servers
Working with HTTP
- HTTP with Python requests: status, headers, body: You will learn to read the status code, headers and body of an HTTP response using Python's requests library.
- Managing sessions and cookies in Python: You will understand how sessions and cookies are kept in Python scripts and manage a logged-in session on your own test application.
- Talking to an API that returns JSON
- Safe requests without turning off TLS verification
- Short task: produce a status report for internal web services
Reading logs
- Log parsing with Python: Apache logs: You will learn to split Apache access log lines into fields with Python so the data can be processed.
- Extracting IPs with regular expressions in Python: You will learn to use Python and regular expressions (regex) to pull IP addresses out of log lines and count how often each one appears.
- Spotting attack signatures in logs with Python: You will learn to write a simple Python check that searches logs for traces of known attack attempts and flags the suspicious lines.
- Counting failed SSH logins in auth.log
- Short task: list the addresses with the most failed logins
Reporting and wrap-up
- Writing CSV reports with Python: You will learn to write your findings from Python into a tidy CSV table that others can open in a spreadsheet program.
- A JSON report other tools can read
- Capstone: a Python tool that builds a security summary from logs: Capstone: you write a small Python tool that reads a fictional company's web logs and summarises suspicious addresses and events.
Practice labs
- Read an SSH server banner: Write a socket script that connects to the lab server, reads its SSH banner and always closes the socket, and show the output with the version.
- Are the inventory services really up: Write a checker that tries the given host and port list with timeouts and marks open, closed and unresponsive separately.
- A hanging service locks the script: Fix a check script that freezes on services that accept connections but never answer or trickle data, using timeouts and error handling, and show the full list finishes in time.
- A status table for internal services: Write a requests script that queries Orchid Hotel’s internal web services and prints status code, response time and server header as a table.
- Turn TLS verification back on: Fix a monitoring script that runs with verify=False so it uses the lab’s internal CA, and show it refuses the service with a forged certificate.
- Pagination on a session-based API: Write a script that logs in to the lab API keeping the session cookie, pulls device records from every page and renews an expired session automatically.
- Addresses with the most failed logins: Write a script that counts failed SSH logins in the given auth.log and lists the five addresses with the most attempts.
- Attack signatures in an access log: Classify directory traversal, SQL injection and scanner traces in the Selvi Schools web server access log with regular expressions, and show sample lines per class.
- A log file with mixed formats: Write a parser that handles two log formats, IPv6 addresses and broken lines without crashing, and report skipped lines in a separate file.
- Extract IPs from email headers: Write a script that extracts IPv4 addresses from the given email headers while rejecting invalid values, and list private and public addresses separately.
- An IPv4 and IPv6 extractor: Extract both IPv4 and IPv6 addresses from firewall logs, validating them with the ipaddress module, and count how often each appears.
- An overly greedy regular expression: Fix a regex that mistakes version numbers and timestamps for IPs and is very slow on large files, and show by timing that it now gives correct results faster.
- A CSV report of failed logins: Write the failed-login counts to a CSV with address, count, first-seen and last-seen columns, and show the file opens in a spreadsheet program.
- JSON another tool can read: Make the security summary you produce for Tulip Pharmacy match the given JSON schema, and show the schema validator passes with no errors.
- An end-of-day summary from logs: Write a tool that combines web, SSH and firewall logs into one report of suspicious addresses, most-targeted accounts and an hourly breakdown.
About this course
Log parsing, scanning and automation scripts.
What you will learn
- Looking at the network with Python
- Working with HTTP
- Reading logs
- Reporting and wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.