Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Effective Python Penetration Testing

By : Rejah Rehim

4 (1)

Effective Python Penetration Testing

4 (1)

By: Rejah Rehim

Overview of this book

Penetration testing is a practice of testing a computer system, network, or web application to find weaknesses in security that an attacker can exploit. Effective Python Penetration Testing will help you utilize your Python scripting skills to safeguard your networks from cyberattacks. We will begin by providing you with an overview of Python scripting and penetration testing. You will learn to analyze network traffic by writing Scapy scripts and will see how to fingerprint web applications with Python libraries such as ProxMon and Spynner. Moving on, you will find out how to write basic attack scripts, and will develop debugging and reverse engineering skills with Python libraries. Toward the end of the book, you will discover how to utilize cryptography toolkits in Python and how to automate Python tools and libraries.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Python Scripting Essentials

1. Python Scripting Essentials

Setting up the scripting environment

Installing third-party libraries

Python language essentials

Summary

2. Analyzing Network Traffic with Scapy

2. Analyzing Network Traffic with Scapy

Sockets modules

Raw socket programming

Investigate network traffic with Scapy

Summary

3. Application Fingerprinting with Python

3. Application Fingerprinting with Python

Web scraping

Parsing HTML with lxml

OS fingerprinting

Get the EXIF data of an image

Web application fingerprinting

Summary

4. Attack Scripting with Python

4. Attack Scripting with Python

Injections

Broken authentication

Cross-site scripting (XSS)

Insecure direct object references

Security misconfiguration

Sensitive data exposure

Missing function level access control

CSRF attacks

Using components with known vulnerabilities

Unvalidated redirects and forwards

Summary

5. Fuzzing and Brute-Forcing

5. Fuzzing and Brute-Forcing

Fuzzing

Classification of fuzzers

Fuzzing and brute-forcing passwords

Dictionary attack

SSH brute-forcing

SMTP brute-forcing

Brute-forcing directories and file locations

Brute-force cracking password protected ZIP files

Summary

6. Debugging and Reverse Engineering

6. Debugging and Reverse Engineering

Reverse engineering

Portable executable analysis

Listing all imported and exported symbols

Disassembling with Capstone

PEfile with Capstone

Debugging

Using PyDBG

Summary

7. Crypto, Hash, and Conversion Functions

7. Crypto, Hash, and Conversion Functions

Cryptographic algorithms

Hash functions

Summary

8. Keylogging and Screen Grabbing

8. Keylogging and Screen Grabbing

Keyloggers

Keyloggers with pyhook

Screen grabbing

Summary

9. Attack Automation

9. Attack Automation

Paramiko

python-nmap

W3af REST API

Metasploit scripting with MSGRPC

ClamAV antivirus with Python

OWASP ZAP from Python

Accessing Nessus 6 API with Python

Summary

10. Looking Forward

10. Looking Forward

Pentestly

Twisted

Nscan

sqlmap

CapTipper

Immunity Debugger

pytbull

ghost.py

peepdf

Summary

Sockets modules

Network sockets is a way to talk to other computers using standard Unix file descriptors, which allow communication between two different processes on the same or different machines. A socket is almost similar to a low-level file descriptor, because commands such as read() and write() also work with sockets as they do with files.

Python has two basic sockets modules:

Socket: The standard BSD sockets API.

SocketServer: A server-centric module that defines classes for handling synchronous network requests that simplify the development of network servers.

Socket

The socket module has almost everything you need to build a socket server or client. In the case of Python, the socket returns an object to which the socket methods can be applied.

Methods in socket module

The socket module has the following class methods:

socket.socket(family, type): Create and return a new socket object
socket.getfqdn(name): Convert a string IP address to a fully qualified domain name
socket.gethostbyname...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Effective Python Penetration Testing

Search

Your notes and bookmarks