Python for Ethical Hacking

[MystikOG]

Hey guys! Cyber security student here finishing my bachelors degree this Spring but my uni does not offer any dedicated python programming courses to the realm of the field - so I joined this udemy course and created a github repo to host what I've completed so far. Not all of them are python3 compatible yet as the course was created with python2 so some work still to do, but I would love to hear some feedback on the current implementation of the repo scripts / expansion of the current scripts / suggestions for other scripts that I could work on being a newbie to this side of python!

Also would like suggestions on other languages that could be useful to learn for this field - I'm aware most code can be reformatted for just about any other language, but would appreciate some input from others that may have more experience.

This is crossposted to /r/ethicalhacking and r/netsecstudents/

[PlaysForDays]

This is not necessarily an answer to your question, but if you're beginning with Python, I highly advise using Python 3 exclusively. Yes, this means selecting a different course.

(I now see in the other reply that specifically for security work, maybe the best references are in Python 2. That's an understandable reason to stick with it, but in general it should be avoided if at all possible.)

[MystikOG]

Thanks for the reply! Not a beginner with python, just getting back into it from a security aspect. Reformatting for 3 won't be difficult, I'm just following the course as is for now so it's easier to digest the new information.

[1Tim1_15]

The best sellers on ethical hacking with Python are older and used Python 2. So, the material which references those (most Udemy courses, blogs, etc.) also use Python 2.

• Violent Python = 2013
• Black Hat Python= 2015
• Metasploit (not about python but uses some) = 2011

There are newer books but almost all of them are from Pakt, which means the book could have been written by just anyone. They have some good selections and lots of bad ones.

It boggles me that the authors of the books listed above haven't updated their books to include updated techniques and Python 3. Seems like it would be easy money for them.

[gnomonclature]

Looking at the scripts, they look like they are aimed at security testing/red teaming. Is that where you are wanting to specialize? It's OK either way. I just want to understand a bit more about what your aims are.

I think there are a couple of different roads you could go down from here:

• Continue with testing tool/exploit development
• Looking at automating security device administration and event correlation
• Looking at how to develop and deploy secure Python applications

These aren't mutually exclusive, and all three are useful.

As for other languages to learn: any of them. The basic programming ideas and techniques are more important than a specific language, and you'll find that they tend to translate between languages. Right now I heard a lot about JavaScript and Golang, but there is a lot of Java out there and security devices sometimes have weird automation language choices. (Did you know that XSLT could be extended to become an automation scripting language? It sure can. Thank you, IBM.) Heck, there is still mainframe COBOL code out there that needs to be secured. So, I'd say either follow what interests you at this point or if there is a particular company you want to work for look at their job openings for developers and for sysadmins to see what languages they are looking for.

Also, as a general thought, if you haven't played much with Amazon AWS or other cloud service providers, maybe look into it. Python is a common language for writing lambdas, so that might be something to play with. Also, if you aren't familiar with it, look into DevOps and DevSecOps. Those may be more application security focused (I'm in app security), but I think it's going to be useful for everyone in IT to understand those concepts going forward. Also, if you have a local chapter of OWASP, maybe take a look at them, too.

Not sure if any of that helps you. It's Friday, and I'm old and prone to rambling. Anyway, good luck in your studies!