Python for security

17 courses, 264 lessons. A real Kali Linux lab in the browser.

First steps in Python for security (Level 101, 16 lessons): You write from scratch the small scripts a security team writes every day: scanning files, hashing, running commands and simple checks.
Python for security operations: sockets and requests (Level 201, 17 lessons): Log parsing, scanning and automation scripts.
Network programming for security: sockets and asyncio (Level 201, 17 lessons): You write fast, polite checking tools for your own network’s hosts with TCP, UDP and asyncio.
Automating web and API checks with Python (Level 201, 15 lessons): You automate sessions, tokens and API calls against your own lab app in Python and write repeatable security checks.
Log analysis and threat hunting with Python (Level 201, 15 lessons): You read, normalise and query Linux, web and Windows event logs in Python to hunt for suspicious behaviour.
Using cryptography correctly in Python (Level 201, 15 lessons): With the cryptography library you set up encryption, signatures, password storage and key handling correctly, and see the common mistakes for yourself.
Python for security practice (Level 201, 16 lessons): You solve short tasks from a real security team’s day in Python: each one starts from a file, a log or a service.
Build your own defence tools (Python) (Level 301, 19 lessons): Inventory, service and HTTP checks, configuration audits and log-alert tools.
Packet crafting and pcap analysis with Scapy (Level 301, 17 lessons): You build packets layer by layer with Scapy, inspect recorded traffic in Python and find suspicious patterns with your own code.
Web application security testing with Python (Level 301, 16 lessons): Step by step you write tools that find input points in your own app, fuzz them in a controlled way and prove OWASP weaknesses.
Detection engineering with Python: Sigma and YARA (Level 301, 16 lessons): You write a small engine that runs Sigma-like rules, automate file scanning with yara-python and protect your detections with tests.
Forensic triage and malware pre-analysis with Python (Level 301, 17 lessons): You automate file signatures, carving, PE and ELF headers, metadata and IOC extraction in Python to triage suspicious files safely.
Network detection with Python: live monitoring and protocol parsing (Level 401, 13 lessons): You build detection tools that watch live traffic in Python, parse protocols with your own dissectors and catch attacks such as ARP poisoning.
Active Directory auditing with Python: ldap3 and impacket (Level 401, 15 lessons): In an authorised lab domain you write tools with ldap3 and impacket that audit accounts, groups, policies and risky configurations.
Security automation and threat intelligence with Python (Level 401, 14 lessons): You write SOAR-style playbooks in Python that handle STIX data, enrich IOCs and go from alert to action; every service is mocked in the lab.
Binary analysis with Python: capstone, lief and pwntools (Level 501, 14 lessons): You disassemble and patch compiled programs in Python and, on training binaries in the lab, prove how memory bugs arise and how they are prevented.
Job project: security automation engineer (Level 501, 12 lessons): As the automation engineer in a fictional company’s security team you design, test and hand over inventory, audit, detection and response tools.

Projects

A password policy checker: You write a Python script that checks candidate passwords against Gelincik Okulları's new password policy, reject those on a common-password list, and produce a clear reason for each rejection.
A failed sign-in report from SSH logs: You parse prepared authentication logs taken from Sedirli Hukuk Bürosu's server with Python, find repeated failed sign-ins and any successes that follow them, and produce a review report.
An audit tool for web security headers and cookie settings: You write a Python tool that checks the security headers and cookie flags of Turnalı Perakende's own web applications in the lab, report what is missing per application, and add the recommended values.
An encrypted, integrity-protected backup tool: You write a Python tool that encrypts and restores Lavinya Klinikleri's reports folder with a key derived from a passphrase, and show that a tampered backup will not open and a wrong passphrase is rejected.
A server configuration drift checker: You write a Python tool that compares users, listening ports and critical configuration files on Karaçam Mobilya's lab servers with the approved baseline, and report the drift by severity.
DNS triage of a prepared capture with Scapy: You analyse a prepared capture from Yakamoz Telekom with Scapy, write a script that finds DNS queries of unusual length and frequency, and prepare a triage note summarising the suspicious endpoints.
A tested pack of Sigma and YARA rules: You write Sigma and YARA rules against log and file samples prepared for Demirsu Enerji's security team, build a test harness in Python, and measure that the rules catch the right samples and stay quiet on clean ones.
A forensic triage report from prepared evidence: You examine a prepared evidence folder collected from a computer at Saklıvadi Üniversitesi with Python, extract file hashes and a timeline, describe the suspicious file statically without running it, and report the findings.
Security automation capstone (Python): You automate repeated security checks with Python and deliver a tool that gathers the findings and produces a readable report.
A live network monitor with rule-based alerts: You write a Python monitor that parses DNS and HTTP traffic crossing your own interface on Kuzeyyıldızı Kargo's lab network live, produce JSON alerts for events matching defined rules, and reduce false alarms.
A read-only Active Directory hygiene audit: You write a Python tool that queries Yelkovan Bankası's lab domain read-only with ldap3, find stale accounts, non-expiring passwords and over-privileged group memberships, and produce a prioritised audit report.
An alert enrichment and ticketing automation: You build a tested Python automation that takes alerts from the log source on Göktaşı Yazılım's lab network, enriches them with a local threat intelligence list, removes duplicates, and opens tickets in the ticket system.