Book Image

Effective Python Penetration Testing

By : Rejah Rehim
Book Image

Effective Python Penetration Testing

By: Rejah Rehim

Overview of this book

Penetration testing is a practice of testing a computer system, network, or web application to find weaknesses in security that an attacker can exploit. Effective Python Penetration Testing will help you utilize your Python scripting skills to safeguard your networks from cyberattacks. We will begin by providing you with an overview of Python scripting and penetration testing. You will learn to analyze network traffic by writing Scapy scripts and will see how to fingerprint web applications with Python libraries such as ProxMon and Spynner. Moving on, you will find out how to write basic attack scripts, and will develop debugging and reverse engineering skills with Python libraries. Toward the end of the book, you will discover how to utilize cryptography toolkits in Python and how to automate Python tools and libraries.

Related Content you might be interested in

Current Title:

Small book image
Effective Python Penetration Testing
Rejah Rehim
Jun, 2016 | 164 pages
No titles found
Table of Contents (11 chapters)
Preface
Preface
What this book covers
What you need for this book
Who this book is for
Conventions
Reader feedback
Customer support
Free Chapter
1
1. Python Scripting Essentials
1. Python Scripting Essentials
Setting up the scripting environment
Installing third-party libraries
Python language essentials
Summary
2
2. Analyzing Network Traffic with Scapy
2. Analyzing Network Traffic with Scapy
Sockets modules
Raw socket programming
Investigate network traffic with Scapy
Summary
3
3. Application Fingerprinting with Python
3. Application Fingerprinting with Python
Web scraping
Parsing HTML with lxml
OS fingerprinting
Get the EXIF data of an image
Web application fingerprinting
Summary
4
4. Attack Scripting with Python
4. Attack Scripting with Python
Injections
Broken authentication
Cross-site scripting (XSS)
Insecure direct object references
Security misconfiguration
Sensitive data exposure
Missing function level access control
CSRF attacks
Using components with known vulnerabilities
Unvalidated redirects and forwards
Summary
5
5. Fuzzing and Brute-Forcing
5. Fuzzing and Brute-Forcing
Fuzzing
Classification of fuzzers
Fuzzing and brute-forcing passwords
Dictionary attack
SSH brute-forcing
SMTP brute-forcing
Brute-forcing directories and file locations
Brute-force cracking password protected ZIP files
Summary
6
6. Debugging and Reverse Engineering
6. Debugging and Reverse Engineering
Reverse engineering
Portable executable analysis
Listing all imported and exported symbols
Disassembling with Capstone
PEfile with Capstone
Debugging
Using PyDBG
Summary
7
7. Crypto, Hash, and Conversion Functions
7. Crypto, Hash, and Conversion Functions
Cryptographic algorithms
Hash functions
Summary
8
8. Keylogging and Screen Grabbing
8. Keylogging and Screen Grabbing
Keyloggers
Keyloggers with pyhook
Screen grabbing
Summary
9
9. Attack Automation
9. Attack Automation
Paramiko
python-nmap
W3af REST API
Metasploit scripting with MSGRPC
ClamAV antivirus with Python
OWASP ZAP from Python
Accessing Nessus 6 API with Python
Summary
10
10. Looking Forward
10. Looking Forward
Pentestly
Twisted
Nscan
sqlmap
CapTipper
Immunity Debugger
pytbull
ghost.py
peepdf
Summary

Missing function level access control

Web applications verify the function level access rights for a user before providing access to a specific functionality. These access control checks also need to be verified server-side. If these types of access checks are missing on the server side, an attacker can enter the application without any authorization. To check this type of vulnerability, we can create custom scripts to authenticate a less privileged user to the application and try accessing restricted pages. We can make sure that all restricted pages are not accessible for any less privileged user.

Previous Section
End of Section 11
Next Section