Automating Information Security with Python

The challenges faced by security professionals are constantly evolving, so there is a huge demand for those who can understand a technology problem and quickly develop a solution. If you have to wait on a vendor to develop a tool to recover a forensics artifact, or to either patch or exploit that new vulnerability, then you will always be behind. It is no longer an option for employers serious about information security to operate without the ability to rapidly develop their own tools. This course will give you the skills to develop solutions so that your organization can operate at the speed of the adversary.

After covering the essentials required for people who have never coded before, the course will present students with real-world forensics, defensive, and offensive challenges. You will develop a malware dropper for an offensive operation; learn to search your logs for the latest attacks; develop code to carve forensics artifacts from memory, hard drives, and packets; automate the interaction with an online website’s API; and write a custom packet sniffer. Through fun and engaging labs, you will develop useful tools and build essential skills that will make you the most valuable member of your information security team.

Course Key Learnings

•  Leverage Python to perform routine tasks quickly and efficiently
• Automate log analysis and packet analysis with file operations, regular expressions, and analysis modules to find evil
• Develop forensics tools to carve binary data and extract new artifacts
• Read data from databases and the Windows Registry
• Interact with websites to collect intelligence
• Develop UDP and TCP client and server applications
• Automate system processes and process their output

Course Content:

Module1  Essentials Workshop with pyWars

Overview

The course begins with a brief introduction to Python and the pyWars Capture-the-Flag challenge. We set the stage for students to learn at their own pace in the pyWars lab environment. With more than 100 labs in the course, there is no shortage of hand-on labs to develop life-changing skills. As more advanced students take on Python-based bonus challenges, students who are new to programming will start from the very beginning with Python essentials.

Topics

• Syntax
• Variables
• Math Operators
• Strings
• Functions
• Control Statements
• Modules

Module2Essentials Workshop with MORE pyWars

Overview

You will never learn to program by staring at PowerPoint slides. This section continues the hands-on, lab-centric approach established at the beginning of the course. It covers data structures and more detailed programming concepts. Next we will discuss how to effectively use Python Virtual Environments to resolve library conflict and organize your environment. Then you will learn how to use Microsoft’s Visual Studio code to effectively debug your programs. We will show you valuable tips and tricks to make you a better Python programmer. Last, we will discuss many of the pitfalls you will encounter as you upgrade your code and dependent libraries from Python2 to Python3.

Topics

• Lists
• Loops
• Tuples
• Dictionaries
• Python Virtual Environments
• Debugging with Visual Studio Code
• Tricks and Shortcuts
• Upgrading from Python2 and Python3

Module3 Defensive Python

Overview

In this section we take on the role of a network defender with more logs to examine than there is time in the day. Attackers have penetrated the network and you will have to analyze the logs and packet captures to find them. We will discuss how to analyze network logs and packets to discover where the attackers are coming from and what they are doing. We will build scripts to empower continuous monitoring and disrupt the attackers before they exfiltrate your data. Forensics and offensive security professional won’t be left out because the skills we will be developing, such as reading and writing files and parsing data, are also essential skill for their craft.

Topics

• File Operations
• Python Sets
• Regular Expressions
• Log Parsing
• Data Analysis Tools and Techniques
• Long-Tail/Short-Tail Analysis
• Geolocation Acquisition
• Packet Analysis
• Packet Reassembly
• Payload Extraction

Module4:  Forensics Python

Overview

In our forensics-themed section, we will assume the role of a forensic analyst who has to carve evidence from artifacts when no tool exists to do so. Even if you don’t do forensics, you will find that the skills covered in this section are foundational to every security role. We will discuss the process required to carve binary images, find appropriate data of interest in them, and extract those data. Once you have the artifact isolated, there is more analysis to be done. You will learn how to extract metadata from image files. Then, we will discuss techniques for finding artifacts in other locations, such as SQL databases, and interacting with web pages.

Topics

• Acquiring Images from Disk
• Memory and the Network
• File Carving
• The STRUCT module
• Raw Network Sockets and Protocols
• Image Forensics and PIL
• SQL Queries
• Web Communications with the Requests Module
• Effective use of Online Website APIs

Module5: Offensive Python