python

This will be the first in a series of blog posts that target those new to both Python and programming.  Python is a very powerful scripting language because of the support it has in the InfoSec community.  This support means many tools are written in Python, and there are many modules that can be leveraged in scripts.  Modules offer functionality that can be imported into a script to accomplish complex tasks in a few lines of code.

This blog post will assume you are using a Linux OS and using Python version 2.x.  When writing Python code you can either type it directly into a Python interpreter or store it in a file.  Many find it very helpful to write their code directly into a Python interpreter and work out the logic and syntax prior to saving it to a file.  Keep in mind that Python enforces the use of indentation which you’ll run into with declaring functions, loops, if/else statements, etc.

The Python Interpreter:
Type ‘python’ in a terminal:

~$ python
Python 2.7.3
Type "help", "copyright", "credits" or "license" for more information.
>>>
>>>

At this point you can type code directly into the Python interpreter.  Below we will define two variables, and use type() function to see if we created a string or integer:

>>>
>>> ip = '8.8.8.8'
>>> port = 53
>>>
>>> type(ip)
<type 'str'>
>>>
>>> type(port)
<type 'int'>
>>>

You can use the built-in help() function to learn about a particular function.  Keep this in mind as you begin to explore more features within the language:

>>>
>>> help(type)
>>>

One thing you’ll commonly want to do is concatenate variables together to print output from the script.  To do this you may need to cast an integer as string using “str()” function:

>>>
>>> print "The IP is: "+ip+" and the port is: "+str(port)
The IP is: 8.8.8.8 and the port is: 53
>>>

Since the variable “IP” was already a string there was no need to cast it as we did with the “port” variable.  Now that you have seen two basic data types (String, and Integer) you can explore what different built-in functions are available to interact with that data type.

Python strings allow you to specify specific offsets in the string, and you can check the length of a given string with len() function.  This can be helpful when you begin doing more advanced string manipulation:


>>>
>>> domain='primalsecurity.net'
>>> domain
'primalsecurity.net'
>>> domain[0]
'p'
>>> domain[0:3]
'pri'
>>> domain[1:]
'rimalsecurity.net'

>>> len(domain)
18

To explore what is possible you can use the dir() function:

>>>
>>> dir(ip)
['__add__', '__class__', '__contains__', '__delattr__', '__doc__', '__eq__', '__format__', '__ge__', '__getattribute__', '__getitem__', '__getnewargs__', '__getslice__', '__gt__', '__hash__', '__init__', '__le__', '__len__', '__lt__', '__mod__', '__mul__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__rmod__', '__rmul__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', '_formatter_field_name_split', '_formatter_parser', 'capitalize', 'center', 'count', 'decode', 'encode', 'endswith', 'expandtabs', 'find', 'format', 'index', 'isalnum', 'isalpha', 'isdigit', 'islower', 'isspace', 'istitle', 'isupper', 'join', 'ljust', 'lower', 'lstrip', 'partition', 'replace', 'rfind', 'rindex', 'rjust', 'rpartition', 'rsplit', 'rstrip', 'split', 'splitlines', 'startswith', 'strip', 'swapcase', 'title', 'translate', 'upper', 'zfill']
>>>

Now you can begin to leverage some of these built-in string functions.  To learn more about a given function you can refer back to the help() function:

>>>
>>> help(ip.split)
>>>
>>> string = ip+':'+str(port)
>>> string
'8.8.8.8:53'
>>>
>>> string.split(':')
['8.8.8.8', '53']

The split function broke the string into a list based on a ‘:’ deliminator.  This is a very useful string function because you can break down a line to extract just portions of interest.  For example, if we just wanted to grab the IP address from the list, we could specify the item we want based on its index in the list.  You can also add and remove items from the list with (.append, and .remove):

>>>
>>> list = string.split(':')
>>>
>>> list
['8.8.8.8', '53']
>>>
>>> list[0]
'8.8.8.8'
>>>
>>> list.append('google')
>>> list
['8.8.8.8', '53', 'google']
>>> list.remove('google')
>>> list
['8.8.8.8', '53']
>>> 

Python Modules:

As mentioned above, Python modules are a very useful way to accomplish complex tasks in fewer lines of code.  Python has many useful built-in modules (os, subprocess, socket, urllib, httplib, re, sys, etc.) and even more 3rd party modules (cymruwhois, scapy, dpkt, spider, etc.).  To leverage a Python module simply type “import <moduleName>”.  The os module is extremely useful because you can run OS commands from within your Python code:

>>>
>>> import os
>>>
>>> dir(os)
['EX_CANTCREAT', 'EX_CONFIG', 'EX_DATAERR', 'EX_IOERR', 'EX_NOHOST', 'EX_NOINPUT', 'EX_NOPERM', 'EX_NOUSER', 'EX_OK', 'EX_OSERR', 'EX_OSFILE', 'EX_PROTOCOL', 'EX_SOFTWARE', 'EX_TEMPFAIL', 'EX_UNAVAILABLE', 'EX_USAGE', 'F_OK', 'NGROUPS_MAX', 'O_APPEND', 'O_ASYNC', 'O_CREAT', 'O_DIRECT', 'O_DIRECTORY', 'O_DSYNC', 'O_EXCL', 'O_LARGEFILE', 'O_NDELAY', 'O_NOATIME', 'O_NOCTTY', 'O_NOFOLLOW', 'O_NONBLOCK', 'O_RDONLY', 'O_RDWR', 'O_RSYNC', 'O_SYNC', 'O_TRUNC', 'O_WRONLY', 'P_NOWAIT', 'P_NOWAITO', 'P_WAIT', 'R_OK', 'SEEK_CUR', 'SEEK_END', 'SEEK_SET', 'ST_APPEND', 'ST_MANDLOCK', 'ST_NOATIME', 'ST_NODEV', 'ST_NODIRATIME', 'ST_NOEXEC', 'ST_NOSUID', 'ST_RDONLY', 'ST_RELATIME', 'ST_SYNCHRONOUS', 'ST_WRITE', 'TMP_MAX', 'UserDict', 'WCONTINUED', 'WCOREDUMP', 'WEXITSTATUS', 'WIFCONTINUED', 'WIFEXITED', 'WIFSIGNALED', 'WIFSTOPPED', 'WNOHANG', 'WSTOPSIG', 'WTERMSIG', 'WUNTRACED', 'W_OK', 'X_OK', '_Environ', '__all__', '__builtins__', '__doc__', '__file__', '__name__', '__package__', '_copy_reg', '_execvpe', '_exists', '_exit', '_get_exports_list', '_make_stat_result', '_make_statvfs_result', '_pickle_stat_result', '_pickle_statvfs_result', '_spawnvef', 'abort', 'access', 'altsep', 'chdir', 'chmod', 'chown', 'chroot', 'close', 'closerange', 'confstr', 'confstr_names', 'ctermid', 'curdir', 'defpath', 'devnull', 'dup', 'dup2', 'environ', 'errno', 'error', 'execl', 'execle', 'execlp', 'execlpe', 'execv', 'execve', 'execvp', 'execvpe', 'extsep', 'fchdir', 'fchmod', 'fchown', 'fdatasync', 'fdopen', 'fork', 'forkpty', 'fpathconf', 'fstat', 'fstatvfs', 'fsync', 'ftruncate', 'getcwd', 'getcwdu', 'getegid', 'getenv', 'geteuid', 'getgid', 'getgroups', 'getloadavg', 'getlogin', 'getpgid', 'getpgrp', 'getpid', 'getppid', 'getresgid', 'getresuid', 'getsid', 'getuid', 'initgroups', 'isatty', 'kill', 'killpg', 'lchown', 'linesep', 'link', 'listdir', 'lseek', 'lstat', 'major', 'makedev', 'makedirs', 'minor', 'mkdir', 'mkfifo', 'mknod', 'name', 'nice', 'open', 'openpty', 'pardir', 'path', 'pathconf', 'pathconf_names', 'pathsep', 'pipe', 'popen', 'popen2', 'popen3', 'popen4', 'putenv', 'read', 'readlink', 'remove', 'removedirs', 'rename', 'renames', 'rmdir', 'sep', 'setegid', 'seteuid', 'setgid', 'setgroups', 'setpgid', 'setpgrp', 'setregid', 'setresgid', 'setresuid', 'setreuid', 'setsid', 'setuid', 'spawnl', 'spawnle', 'spawnlp', 'spawnlpe', 'spawnv', 'spawnve', 'spawnvp', 'spawnvpe', 'stat', 'stat_float_times', 'stat_result', 'statvfs', 'statvfs_result', 'strerror', 'symlink', 'sys', 'sysconf', 'sysconf_names', 'system', 'tcgetpgrp', 'tcsetpgrp', 'tempnam', 'times', 'tmpfile', 'tmpnam', 'ttyname', 'umask', 'uname', 'unlink', 'unsetenv', 'urandom', 'utime', 'wait', 'wait3', 'wait4', 'waitpid', 'walk', 'write']
>>>

As you can see above the os module gives you loads of functionality.  One I find myself using a lot is “os.system” since we can just pass it a command and have it executed by the underlying OS.  Below we will execute the following command “echo ‘UHJpbWFsIFNlY3VyaXR5Cg==’ | base64 -d”:

>>>
>>> os.system("echo 'UHJpbWFsIFNlY3VyaXR5Cg==' | base64 -d")
Primal Security
>>>

Creating a File Object:
Now we will show some basic examples of how to read data from a file and create a file in Python.  The screen shot below demonstrates how you can create a file object, and read/write data to the object.  Often you’ll find yourself reading in input from a file, doing some logic and then writing the output to a file:

>>>
>>> file = open('test.txt', 'w')
>>> file.write('Hello World')
>>> file.close()    
>>> file = open('test.txt', 'r')
>>> file.readlines()
['Hello World']
>>>

Practice these concepts in a Python interpreter to solidify them because they will be leveraged in more complex examples in future tutorials.  When developing code I like to have two terminals up parallel to each one, one to type directly into a Python interpreter, and the other to pull the logic over into a script.  The next tutorial goes over coding in an actual Python script, definitions, classes, and the sys module.