Book Image

Python Penetration Testing Cookbook

By : Rejah Rehim
Book Image

Python Penetration Testing Cookbook

By: Rejah Rehim

Overview of this book

Penetration testing is the use of tools and code to attack a system in order to assess its vulnerabilities to external threats. Python allows pen testers to create their own tools. Since Python is a highly valued pen-testing language, there are many native libraries and Python bindings available specifically for pen-testing tasks. Python Penetration Testing Cookbook begins by teaching you how to extract information from web pages. You will learn how to build an intrusion detection system using network sniffing techniques. Next, you will find out how to scan your networks to ensure performance and quality, and how to carry out wireless pen testing on your network to avoid cyber attacks. After that, we’ll discuss the different kinds of network attack. Next, you’ll get to grips with designing your own torrent detection program. We’ll take you through common vulnerability scenarios and then cover buffer overflow exploitation so you can detect insecure coding. Finally, you’ll master PE code injection methods to safeguard your network.
Table of Contents (15 chapters)

What this book covers

Chapter 1, Why Python in Penetration Testing?, begins with the importance of Python in security testing and shows the reader how to configure the basic environment.

Chapter 2, Setting Up a Python Environment, deals with how to set up the environment in different operating systems to start penetration testing with them.

Chapter 3, Web Scraping with Python, decodes how to download web pages with Python scripts, and provides you with the basics of web scraping, followed by a detailed description of how to use regular expressions to get information from downloaded web pages with Python scripts, and, also, how to request and download dynamic website pages to crawl the data in it.

Chapter 4, Data Parsing with Python, shows you how to parse HTML tables with the help of Python modules to download data in tables from websites and to extract data from HTML documents and generate .csv/Excel sheets with the help of scripts.

Chapter 5, Web Scraping with Scrapy and BeautifulSoup, is where you will learn how to build and run web spiders to crawl to web pages with the Python Scrapy module. Also, how to use the interactive shell of Scrapy will be explained, where you can try and debug your scraping code very quickly within the Terminal. It also deals with how to extract links from web pages crawled by Scrapy and to use those links to get more pages from the website. Learn how to detect and traverse links to other pages and grab data from those pages with the Scrapy module.

Chapter 6, Network Scanning with Python, teaches how to create a scanner to scan an IP for its open ports to get details, and how to create a stealth scanning script with the help of Scapy. Also, how to create a script to scan a range of IPs with Python and how to use the LanScan Python 3 module, which helps scan networks, will be dealt with. With LanScan, we can gather information about the hosts and devices on the local network.

Chapter 7, Network Sniffing with Python, is a detailed guide on how to write a basic packet sniffer, how to write scripts to parse the sniffed packets with Python, how to parse and format a MAC address with Python modules, how to decode a sniffed packet with the help of Python modules, and how to use Pyshark, a Python wrapper for TShark.

Chapter 8, Scapy Basics, deals with how to create a packet with the Scapy Python module, which helps craft custom packets, and how to send packets and receive answers with Scapy. Also, how to write scripts that can read from a pcap file and write back with the Scapy module is explained. Scapy is all about the layering of protocols together to make custom packets. This section will help readers get a clearer picture of layering packets with Scapy and how to use Scapy to sniff network packets.

Chapter 9, Wi-Fi Sniffing, looks at how to write scripts to scan and get a list of the Wi-Fi devices available with the help of Python modules. You will also learn how to write scripts to find hidden Wi-Fi SSIDs with the help of Python modules, as well as how to write scripts to expose hidden SSIDS with Scapy. Also, how to write a script that can run a dictionary attack on hidden Wi-Fi SSIDs with Scapy and how to set up a fake access point with Scapy are covered.

Chapter 10, Layer 2 Attacks, explores how to write a script to watch a network for all newly connected devices to that specific network and how to write a script that can run an address resolution protocol (ARP) cache poisoning attack. You will also learn to write a script to create a MAC flooding attack with the Python Scapy module and to write a Python script to create a VLAN hopping attack. Also, we will cover how to write a script that can spoof ARP with Python over VLAN hopping.

Chapter 11, TCP/IP Attacks, focuses on how to write a script to spoof IPs with Python modules. You will also learn how to write a script to create a SYN flooding attack with Python and how to write a Python script that can sniff passwords over local area network.

Chapter 12, Introduction to Exploit Development, will help you learn the basics of CPU registers and their importance, and will explain the memory dump technique, as well as the basics of CPU instructions.

Chapter 13, Windows Exploit Development, will help you learn the details of Windows memory layout, which will help in exploit development. You will also learn how to write a Python script for buffer overflow attacks with saved return pointer overwrite, and how to write scripts to exploit Structured Exception Handling (SEH) with Python. Also, we will see, in detail, how to write scripts to exploit Windows applications using Egg Hunters with Python.

Chapter 14, Linux Exploit Development, explains how to write scripts to run the Linux Format String exploit with Python and how to exploit buffer overflow in a Linux environment with Python.