Chapter 1, Understanding the Penetration Testing Methodology, highlights the specific tactics, techniques, and procedures that assessors use to evaluate the resistance of an organization's security strategy. It also covers Simulated malicious actors and the common tools of the trade.

Chapter 2, The Basics of Python Scripting, helps grow the skills of transition programmers and new assessors with the Python language, which culminates into writing useful assessor scripts.

Chapter 3, Identifying Targets with Nmap, Scapy, and Python, builds the foundational network packet and protocol knowledge, which then translates directly into writing Python scripts that utilize the Nmap and Scapy libraries to automate target identification for exploitation.

Chapter 4, Executing Credential Attacks with Python, showcases the most common ways by which attackers gain initial access to resources not withstanding phishing. It focuses on industry-leading practices regarding accurately targeting an organization.

Chapter 5, Exploiting Services with Python, features how exploits are identified to gain initial access, how post-exploitation techniques are researched to gain privileged access, and how that access is leveraged to gain access to other systems using automated scripts.

Chapter 6, Assessing Web Applications with Python, is a climax of techniques that pivot on the automation of analyzing a web application's weaknesses. This is where Python can be used to improve assessments of complex applications with chained techniques.

Chapter 7, Cracking the Perimeter with Python, emphasizes some of the common techniques that real malicious actors and assessors alike use to gain access to the semi-trusted and trusted networks of an organization. This is done using tools and techniques that include Python and hinge on current industry practices.

Chapter 8, Exploit Development with Python, Metasploit and Immunity, underscores how basic exploits and Metasploit modules are researched, written, and updated by assessors to capture the risk of using poorly developed, outdated, or unsupported software on relevant systems.

Chapter 9, Automating Reports and Tasks with Python, stresses assessors' need to save as much time as possible on assessments, by creating Python scripts that automate the analysis of security tool results and outputs to include eXtensible Markup Language (XML), in an effort to provide usable reporting formats.

Chapter 10, Adding Permanency to Python Tools, is the final chapter. It features the ways in which you can update your scripts to take advantage of advanced capabilities, such as logging, multithreading, and multiprocessing, to create industry-standard tools.

The most important things you need are the will to learn and the drive to improve your capabilities. Supporting these, you will need a system that can support multiple Virtual Machines (VMs) that run within an industry-standard hypervisor, such as VMware Workstation (a recent version) or Virtual Box. The preferred solution is VMware Workstation running on a recent version of Windows, such as Windows 7. An Internet connection will be required to allow you to download the supporting libraries and software packages, as necessary. Each of the detailed software packages and libraries will be listed at the beginning of each chapter.

If you are a security professional or researcher with knowledge of different operating systems and a conceptual idea of penetration testing, and you would like to grow your knowledge in Python, then this book is ideal for you.

In this book, you will find a number of text styles that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: "We can include other contexts through the use of the include directive."

A block of code is set as follows:

try:
    import docx
    from docx.shared import Inches
except:
    sys.exit("[!] Install the docx writer library as root or through sudo: pip install python-docx")

Any command-line input or output is written as follows:

echo TEST > my_wordlist

New terms and important words are shown in bold. Words that you see on the screen, for example, in menus or dialog boxes, appear in the text like this: "We organize the vulnerabilities by Number Of Exploits Descending to find the exploitable vulnerabilities."

Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of.

To send us general feedback, simply e-mail <[email protected]>, and mention the book's title in the subject of your message.

If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.