SecurityTube
Python
Scrip1ng
Expert
(SPSE)
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
1:
Introduc6on
to
Python
and
Se8ng
up
an
Environment
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Python
–
a
short
history
• Created
in
1989
by
Guido
Van
Rossum
(works
for
Google)
• Python
2.x
in
2000
• Python
3.x
in
2008
– Not
backward
compa1ble
• 2.x
is
the
status
quo
• 3.x
future
©SecurityTube.net
Why
Python?
• Open
Source
• Mul1-‐PlaXorm
• Rich
set
of
libraries
• Large
number
of
open
source
tools
• HLL
used
for
Rapid
Prototyping
©SecurityTube.net
Mul1ple
OS
Support
• Unix
/
Linux
• Mac
OS
X
• Windows
• Mobile
PlaXorms
–
Android,
iOS
• Embedded
Systems
©SecurityTube.net
Implementa1ons
• Cpython
–
reference
implementa1on
“Python”
• Jython
–
Python
in
Java
• IronPython
-‐
Python
in
C#
More:
hAp://wiki.python.org/moin/PythonImplementa1ons?
ac1on=show&redirect=implementa1on
©SecurityTube.net
Why
Python
in
Infosec?
• Rapid
prototyping
-‐
POC
• Extensive
library
support
• Tons
of
tools
already
wriAen
©SecurityTube.net
Python
on
different
OSs
• Linux
– Pre-‐Loaded
• Windows
– Ac1veState
Python
• MAC
– Pre-‐loaded
J
©SecurityTube.net
Python
2.7
or
3.x?
• Emphasis
on
2.7
• Most
tools
/
libraries
s1ll
do
not
support
3.x
• Eventually
everything
will
support
3.x
– Will
take
a
couple
of
years
©SecurityTube.net
PlaXorm
of
Choice
• Ubuntu
Server
11.10
64-‐Bit
hAp://www.ubuntu.com/download/server/download
• Will
be
running
inside
Virtualbox
• Connect
to
it
over
SSH
using
PuAy
or
any
other
client
of
your
choice
©SecurityTube.net
Customary
“Hello
World”
• Interac1ve
mode
• Script
©SecurityTube.net
Module
1:
Exercise
1
• Install
Python
3.x
in
Ubuntu
11.10
• How
can
you
switch
between
different
versions
of
Python?
– Console
– Script
• Explore
Virtualenv
in
Python
©SecurityTube.net
SecurityTube
Python
Scrip1ng
Expert
(SPSE)
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Exercise
1
• Install
Python
3.x
in
Ubuntu
11.10
• How
can
you
switch
between
different
versions
of
Python?
– Console
– Script
• Explore
Virtualenv
in
Python
©SecurityTube.net
Install
Python
3
• Apt-‐get
install
python3
©SecurityTube.net
Install
Python
Virtualenv
• Install
PIP:
apt-‐get
install
python-‐pip
• Pip
install
virtualenv
©SecurityTube.net
What
is
Virtualenv?
• Allows
crea1on
of
isolated
python
environments
• Takes
away
the
pain
of
library
version
issues
• Each
environment
is
isolated
– Can
be
configured
to
not
use
globally
configured
libs
as
well
• hAp://www.virtualenv.org/en/latest/index.html
©SecurityTube.net
Crea1ng
a
Virtual-‐Env
for
Python
3.x
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
2:
Variables
and
Data
Types
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Variables,
Objects
and
References
Reference
name
vivek
Variable
Object
©SecurityTube.net
Data
Types
• Strings
• Numbers
• Lists
• Dic1onaries
• Tuples
• Boolean
• …
©SecurityTube.net
Strings
• Defini1on
– name
=
“vivek”
– name
=
‘vivek’
– name
=
“vivek’s”
– name
=
“vivek\nramachandran”
– name
=
r’vivek\nramachandran’
(raw
string
turns
off
escaping)
– name
=
“””
Vivek
Ramachandran
“””
©SecurityTube.net
Unicode
String
• Used
for
Interna1onaliza1on
• “wide
characters”
are
they
are
called
• name
=
u’vivek’
• unicode
to
regular
string
conversion
– str(name)
• regular
string
to
unicode
conversion
– unicode(name)
©SecurityTube.net
String
Opera1ons
• strings
are
immutable
objects
in
Python
• Concatena1ng
strings
– s1
+
s2
• Repeated
sequence
in
string
– buffer
=
“A”*20
• Slicing
–
breaking
up
the
string
– string[start:end:steps]
• Int
to
String
– str(42)
©SecurityTube.net
String
Methods
• string.find(…)
• string.replace(….)
• string.split(….)
• ….
©SecurityTube.net
String
Formavng
• “Hack
this
IP:
%s”
%
ip
• “Hack
%s
with
IP
%s”
(domain,
ip)
• “Hack
%(domain)s
with
IP
%(ip)s”
%
{
“domain”
:
”securitytube.net”,
“ip”
:
“192.168.1.10”
}
©SecurityTube.net
Numbers
• Integers,
Floats
etc.
can
be
represented
• Operators
– +,-‐,*,/
– x**y
(x
to
the
power
y)
– (>,=,<,>=,<=,
==)
– x|y,
x^y,
x&y
(bitwise
operators)
– x
and
y,
x
or
y,
not
x
(logical
operators)
©SecurityTube.net
Lists
• Collec1on
of
objects
which
can
be
heterogeneous
• myList
=
[1,2,3,4]
• myList
=
[1,
‘vivek’,
‘SPSE’,
2.5]
• myList
=
[1,
[3,4,
‘hello’],
[3,4],
2,
3]
• len(myList)
• len(myList[1])
©SecurityTube.net
List
Opera1ons
• Concatenate
[1,2]
+
[3,4]
=
[1,2,3,4]
• Append
-‐-‐
list.append()
• Extend
-‐-‐-‐
list.extend([])
• Reverse
-‐-‐
list.reverse()
• Pop
-‐-‐
list.pop()
• Insert
-‐-‐
list.insert(index,
item)
• Delete
-‐-‐
del
list[index]
©SecurityTube.net
Module
1:
Python
Language
Essen1als
End
of
Part
2:
Variables
and
Data
Types
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
3:
Data
Types:
Tuple,
Sets,
Dic6onaries
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Tuple
• Tuples
are
similar
to
lists
but
immutable
• Can
covert
from
list
to
tuple
and
vice
versa
– tuple(list)
– list(tuple)
• video
=
(“Hello
World”,
5,
10,
0)
• sequence
unpacking
– videoName,
1me,
upvotes,
downvotes
=
video
©SecurityTube.net
Sets
• Unordered
collec1on
of
unique
objects
• List
to
set
:
b
=
set(a)
• Set
to
list:
a
=
list(b)
• Set
Opera1ons
– Union:
a|b
– Intersec1on:
a&b
– Difference:
a-‐b
– …
©SecurityTube.net
Dic1onaries
• Unordered
key-‐value
pairs
• Keys
are
unique
and
immutable
objects
• Value
can
change
• dict
=
{}
,
dict[‘name’]
=
‘vivek’
• dict(name=‘vivek’,
age=‘31’)
• dict
=
{
‘name’
:
‘vivek’,
‘age’
:
31
}
• Check
if
a
given
key
is
present
– dict.has_key(key)
– key
in
dict
©SecurityTube.net
Dic1onary
Opera1ons
• Get
tuple
of
items:
dict.items()
• Get
list
of
keys:
dict.keys()
• Get
list
of
values:
dict.values()
• Get
a
par1cular
item:
dict.get(key)
• Item
dele1on
– All
items:
dict.clear()
– One
item:
del
dict[key]
©SecurityTube.net
Gevng
Help
on
Methods
etc.
• dir()
–
lists
all
aAributes
• help(string.replace)
-‐
list
method
help
©SecurityTube.net
Module
1:
Python
Language
Essen1als
End
of
Part
3:
Data
Types:
Tuple,
Sets,
Dic6onaries
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
4:
Condi6onal
Statements
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
If
Statement
if
test_condi1on1:
do
stuff
do
stuff
elif
test_condi1on2:
do
stuff
do
stuff
elif
test_condi1on3:
do
stuff
do
stuff
else
:
do
stuff
©SecurityTube.net
While
Loops
while
statement_is_true:
do
stuff
do
stuff
-‐
break:
get
out
of
innermost
loop
-‐
con1nue:
start
the
next
pass
of
the
innermost
loop
-‐
pass:
do
nothing,
placeholder
©SecurityTube.net
Exercise
• While
loops
can
also
have
a
“else”
in
Python
• explore
this
func1onality
and
write
a
simple
program
to
illustrate
©SecurityTube.net
For
loops
for
item
in
object:
do
stuff
do
stuff
for
item
in
[1,2,3]
for
item
in
[‘a’,
2,
‘3’]
for
(x,y)
in
[(“vivek”,
31),
(“john”,
25)]
©SecurityTube.net
Exercise
• For
loops
can
have
a
“else”
statement
as
well
• write
a
simple
program
to
illustrate
this
func1onality
©SecurityTube.net
Emula1ng
C
style
FOR
loops
C
style
loops:
for
(i=1;
i<10;
i++)
Use
range
in
python:
range(lower,
upper,
step)
creates
a
list
for
use
range(n)
–
[0,
……,
n-‐1]
©SecurityTube.net
Module
1:
Python
Language
Essen1als
End
of
Part
4:
Condi6onal
Statements
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
5:
Func6ons
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Func1ons
• Func1ons
allow
sec1ons
of
code
to
be
grouped
beAer
as
per
func1onality
• def
func1on(arg1,
arg2=default,
..)
:
– …
– …
– return
value
©SecurityTube.net
Module
1:
Python
Language
Essen1als
End
of
Part
5:
Func6ons
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
6:
Classes
and
Objects
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Class
Class
Calculator:
def
__init__(self,
inp1,
inp2):
self.a
=
inp1
self.b
=
inp2
def
sum(self):
return
self.a+self.b
def
product(self):
return
self.a*self.b
©SecurityTube.net
Inheritence
Class
Scien1ficCalculator
(Calculator):
def
power(self):
return
pow(self.a,
self.b)
©SecurityTube.net
Exercise
• What
are
Global,
Class
and
Instance
variables?
• How
can
we
override
a
method
in
parent
class?
©SecurityTube.net
Module
1:
Python
Language
Essen1als
End
of
Part
6:
Classes
and
Objects
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
7:
Crea6ng
Modules
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Modules
• BeAer
way
of
organizing
code
• can
define
classes,
func1ons
and
variable
• import
MODULE_NAME
• from
MODULE_NAME
import
….
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
7:
Crea6ng
Modules
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
8:
Crea6ng
Packages
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Packages
• hierarchical
file
directory
structure
to
organize
code
• consists
of
modules
and
sub-‐packages
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
9:
Excep6on
Handling
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Excep1ons
• Simply
put
excep1ons
are
error
condi1ons
which
disrupt
the
normal
flow
of
the
program
• Python
allows
for
a
simple
and
elegant
way
to
handle
excep1ons
©SecurityTube.net
Exercise
• Python
allows
for
user
defined
excep1ons
• Code
up
a
demo
which
has
a
user
defined
excep1on
and
an
example
use
case
©SecurityTube.net
Module
1:
Python
Language
Essen1als
End
of
Part
9:
Excep6on
Handling
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Module
1:
Python
Language
Essen1als
Part
10:
Python
on
other
Devices
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
Python
on
the
iPhone
(iOS)
• On
a
Jailbroken
iPhone
using
Cydia
– install
Python
scrip1ng
support
• Original
Blog
post
by
Saurik:
hAp://www.saurik.com/id/5
• Can
do
a
ton
of
stuff!
Lets
read
the
SMS
DB
• With
restric1ons
–
Python
for
iOS
hAp://itunes.apple.com/us/app/python-‐for-‐ios/
id485729872?mt=8&ign-‐mpt=uo%3D4
©SecurityTube.net
Python
on
Android
• Scrip1ng
Layer
for
Android
hAp://code.google.com/p/android-‐scrip1ng/
Exercise:
Install
the
scrip1ng
layer
on
your
Android
Phone
and
try
the
previous
demo
©SecurityTube.net
Python
in
your
Wi-‐Fi
Router
• Open
Source
firmwares
such
as
DD-‐WRT
support
running
Python
on
them
hAp://www.dd-‐wrt.com/site/index
Exercise:
Purchase
a
DD-‐WRT
compatable
router
(DLINK
DIR-‐615
E4)
and
run
python
on
it
©SecurityTube.net
Module
1:
Python
Language
Essen1als
End
of
Part
10:
Python
on
other
Devices
hAp://www.securitytube.net
Vivek
Ramachandran
Course
Instructor
©SecurityTube.net
