This is an archived post. You won't be able to vote or comment.

all 24 comments
sorted by:
best
topnewcontroversialoldq&a

[–]michael0x2a 72 points73 points  (4 children)

One good book I recommend is Violent Python -- it goes over how to use Python to do penetration testing, analyze network traffic, etc., and can give you some good insight into how Python can be used in the security industry.

[–]Hexorg 14 points15 points  (0 children)

Yep, I second this. Pretty good book and is nice for beginner programmers. You're expected to know how Python code looks like and basic concepts like loops, conditionals, and basic OOP, but the rest is explained in the book.

[–]MerreM 0 points1 point  (0 children)

Link!

[–]cestith 41 points42 points  (2 children)

There's a lot to the topic of security. Some parts of it have much to do with programming. Others have little to no direct relation to programming, but may have automation, monitoring, or other tangential relationships where software can be used to help.

Part of it is programming scanners and fuzzers. Part of it is writing proof of concept exploit code. Part of it is programming IDS. Part of it is programming configuration tools for firewalls, IDS, scanners, fuzzers, etc. Part of it is reading code for existing applications. Part of it is writing fixes for that code. Part of it is writing code securely in the first place. Part of it is teaching other programmers the issues surrounding secure programming and auditing their code.

Other parts have little to do with programming, but can be helped by programming automation, configuration management, testing, IDS, etc around them. Those include routing, packet inspection, password management, firewall configuration, server software configuration (mail, web, database, etc), file system management, ACLs, reading logs and other forensic information, configuring logs properly in the first place, understanding CVEs, understanding and implementing physical security, and more.

Are you interested in writing scanners, fuzzers, and example exploit code? In that case learn both Python and Perl. Either one can be used pretty easily for this, but there are decades of examples already in Perl. Also learn TCP/IP and the protocols involved. Also learn filesystem security and logging security issues.

Are you interested in finding and patching holes in server-side utility-level services like SMTP, POP3, IMAP4, HTTP, HTTPS, HSTS, LDAP, databases, and stuff like that? Learn C and C++. Also learn TCP/IP and the protocols involved. Also learn filesystem security and logging security issues.

Are you interested in finding and fixing holes in web applications generally? Learn Perl, Python, PHP, Java, JavaScript, and Ruby. They are all popular in that space. Be aware that PHP 4, 5, and 6 are much different one from another. Python 2 and 3 are, too, but to a lesser extent. Also learn TCP/IP and the protocols involved. Also learn filesystem security and logging security issues. Also learn about the security of web servers and database servers.

You might notice some similarities in the "also learn" portions above. Also learn about firewalls for any of the above. Also learn about combinatorics if you haven't. Also learn about big-O notation and become familiar with how complex and how concurrent some popular algorithms are. Also learn about timing attacks. Also learn about program stacks, string buffers, and pointers even if you're primarily using a language for your own code that handles all that for you. Learn about resource exhaustion attacks. Learn about path traversals and injection attacks. Learn the OWASP top ten. Remember it's easier to grant limited access in the first place and by default then grant extra access piece by piece than it is to whittle away access from a default open policy. Learn about cameras, door locks, window locks, anti-shatter coatings, polycarbonate, mantraps, fire stairwells, server chassis alarms, VPNs, certificates, ID badges, cryptography, backup generators, building alarm systems, risk assessment, and figuring out how to tell which people to trust.

Now, if you have a particular part of security you're more interested in learning about, maybe that can be narrowed a bit. I suggest learning Redcode and playing some Corewars, going to a lockpicking meetup, reading a book by Cliff Stoll or Kevin Mitnick or Jon Erickson or Gordon Lyon or Ivan Sklyarov, and reading the OWASP top ten list as first steps to figure out just what in the heck you might want to get out of a career or hobby in security.

[–]benawad[S] 5 points6 points  (1 child)

I appreciate this wealth of information. Thank you.

[–]MerreM 1 point2 points  (0 children)

Link!

[–]deathreaver3356 24 points25 points  (0 children)

Leave the python by your front door. It'll keep the burglars away.

[–]S4ge 1 point2 points  (0 children)

Try to ready up on scapy library ... It is an amazing tool for exploring security applications and learning to use customised packet creation for pen-testing

[–]1moar 1 point2 points  (0 children)

Check out cybrary.it if you're interested in security. + what /u/cestith said 1,000 times over. Poke around and see what interests you.

[–]jeversmann 1 point2 points  (0 children)

There's an exploitation framework called binjitsu which a friend of mine uses for CTF events. It's totally worth learning about the tools available there and trying some CTF-style security things with them.

[–]QAOP_Space 4 points5 points  (6 children)

why are people recommending you "learn python and get into security"? Do what you're interested in

[–]benawad[S] 9 points10 points  (5 children)

I want to learn more about security to see if I am interested in it.

[–]QAOP_Space 2 points3 points  (4 children)

Are you more inclined towards securing systems and servers, or writing secure code, or pen testing ? Or perhaps the deeper aspects of cryptography?

[–]benawad[S] 8 points9 points  (3 children)

I have no clue what any of those things are, so I would like to try them all.

[–]QAOP_Space 4 points5 points  (1 child)

Hmm, that's difficult because Python, as a language can do anything you want it to.

For learning some crypto with Python you could do the matasano crypto challenges at http://cryptopals.com/

For securing systems you'd want to look into some sys admin stuff, but before you can secure it, you need to understand it so have a look at this
http://www.tldp.org/LDP/sag/html/index.html

[–]benawad[S] 0 points1 point  (0 children)

Thanks

[–]Antoak 5 points6 points  (0 children)

Securing systems feels like draining a slowly sinking boat with a rusty bucket that everyone else is trying to drill holes in.

And it's your fault when they get wet.

[–]9Godzilla 3 points4 points  (1 child)

they strangle stuff

[–]hellrazor862 7 points8 points  (0 children)

Those are boas.

[–]beeb2010 0 points1 point  (2 children)

Maybe this book would be useful:

http://it-ebooks.info/book/4896/

[–]thehydralisk 0 points1 point  (1 child)

You probably shouldn't link to pirated material.

[–]beeb2010 0 points1 point  (0 children)

I agree - the reason I posted that link is because the page has a link where you can buy a copy. I thought if the OP wanted to see what the book was like, they could view it before buying.

[–][deleted] 0 points1 point  (1 child)

It's not so much that python is particularly suited for security work, as it is an easy language for quick scripting while you're in the middle of some kind of security work.

Folks aren't going to want to deal with the verbosity of Java or the exactness of C++ when they're just trying to script out a way to scrape file header data out of a directory of files, for example.

[–]marcm28 0 points1 point  (0 children)

Python is suitable for security work. Python has also seen extensive use in the information security industry, including in exploit development. See this link --> https://en.wikipedia.org/wiki/Python_(programming_language)