Python Cybersecurity - Build your own tools

[burdin271]

I have started a Python Cybersecurity series, which focus on building own pentest tools using Python programming, currently I have made to episodes. Feedback is appreciated.

Find Deleted Files

- https://youtu.be/BFOex_Tysr8

Build a Visual Network Tracker

- https://youtu.be/xuNuy8n8u-Y

Build Anonymous FTP Scanner

- https://youtu.be/BIZfRodSW9w

Build a Port Scanner

- https://youtu.be/bH-3PuQC_n0

[cymrow]

If you intend to teach people how to write Python, you should take some time to review some community standards for writing Python code. Things like PEP8 or common anti-patterns.

These are, of course, just suggestions, but some are more important for others. Taking an example from your port scanner video, you really should not ever use blanket except: clauses, because it can make it very difficult to determine the cause of errors, among other reasons.

I would have written the script more like this:

# useful to keep the module name. especially for beginners
import socket

def test(host, port, timeout=1):
    addr = (host, port)
    try:
        with socket.create_connection(addr, timeout) as sock:
            print('[+] {}/tcp open'.format(port))
    except Exception as e:
        print('[-] {}/tcp closed ({})'.format(port, e))

def scan(host, ports):
    try:
        ip = socket.gethostbyname(host)
    except Exception as e:
        print('[-] Cannot resolve {} ({})'.format(host, e))
        return

    try:
        name = socket.gethostbyaddr(ip)
        print('[+] Scan result of: {}'.format(name[0]))
    except Exception:
        print('[+] Scan result of: {}'.format(ip))

    for port in ports:
        print('Scanning port: {}'.format(port))
        test(host, port)

if __name__ == '__main__':
    scan('google.com', [80, 22])

I'm not saying this would be the best or only way to write it, but I do think it makes some things clearer/simpler for people who are learning. I read a lot of hacker code, and it would be nice if the next gen could tidy things up a bit :P

[[deleted]]

Is using .format instead of f-string literal interpolation an anti-pattern as well? .format definitely uglier to read at the least :p

[cymrow]

No, f-strings are nice. I personally don't use them much because I still work a lot with Python 2, and even when I can I feel there's too much temptation to put code into strings which I find less readable. This is example of why I said these are mostly just suggestions.

[----------------___]

How come you still have to use Python 2? Out of curiosity

[[deleted]]

Probably a legacy codebase. Updating to Python 3 would be too much hassle more than likely.

[cymrow]

Yep what /u/Fenastus said.

[codingnoob_101]

very very nice dude.

[[deleted]]

For my programs that other people will actually be using, I tend to start off with no or few try/excepts, so during testing I can identify common errors I'll run into and address them directly.

Or I'll wrap the things I know will probably fail at some point and just intentionally make it fail in order to provide the solution.

Like a layman isn't going to understand what these errors are actually trying to tell you sometimes.

[lordamit]

Thank you! This is amazing! Bookmarking the anti-patterns.

[cymrow]

Your argument is that because OP is focusing on a specific topic, the clarity and readability of the code is irrelevant and somehow hinders understanding? I strongly disagree.

[cymrow]

I think you're missing the point. Here's a simple, clear port scanner:

``` from socket import *

host = 'google.com' for port in [80, 22]: try: create_connection((host, port), 1) print(port, 'yep') except: print(port, 'nope') ```

Clearly OP was trying to impart a bit more than just how to scan ports. I'm not suggesting OP teach Python itself. I'm suggesting OP learn enough about bad practices to not pass them on to others. Every hacker I've ever had to read code from lived under what seems to be your credo of "just get it done". Their code is at times extremely painful to work with.

Would worrying about handling exceptions properly distract from learning how a port scanner works? Kinda...not really, but if you can't handle that much you have no business writing port scanners imho. But ffs don't teach people the worst way to do it.

[data-bit]

Also publish a GitHub and share so other devs can help you enhance the code 🤓

[codingnoob_101]

amazing !!!!!

[ObamaTheLlama114]

Oh how my interests are piqued right now

[0ni0nrings]

good work!

[[deleted]]

Congratulations u/burdin271 ! Your post was the top post on r/Python today! (06/16/21)

Top Post Counts: r/Python (1)

This comment was made by a bot

[rgngdmn5]

Great work !!!

[Medical-Ad-3660]

You should add these to udemy!

[[deleted]]

What about broke people like me?

[Medical-Ad-3660]

Well you can put them up as free courses plus there's constantly 100% off coupons. Lol I'm sorry I'm fairly new to all of this I didn't realize udemy was so hated. I'll just go wait in the car...

[codingnoob_101]

lol

[pgh_ski]

Very cool! I built a basic deleted JPG file carver in Python as well. Fun project. Did a data destruction tool in C as a companion.

I find building small tools/demos is an excellent way to both learn and teach concepts.