Effective Python Penetration Testing

The Linux system is built in a way that makes it smooth for users to get started with Python programming. Most Linux distributions already have Python installed. For example, the latest versions of Ubuntu and Fedora come with Python 2.7. Also, the latest versions of Redhat Enterprise (RHEL) and CentOS come with Python 2.6. Just for the record, you might want to check this, though.

If it is not installed, the easiest way to install Python is to use the default package manager of your distribution, such as apt-get, yum, and so on. Install Python by issuing this command in the terminal:

    $ sudo apt-get install python2

    $sudo yum install python

To install Geany, leverage your distribution's package manager:

    $sudo apt-get install geany geany-common

    $ sudo yum install geany

Even though Macintosh is a good platform to learn Python, many people using Macs actually run some Linux distribution or other on their computer, or run Python within a virtual Linux machine. The latest version of Mac OS X, Yosemite, comes with Python 2.7 pre-installed. Once you verify that it is working, install Sublime Text.

For Python to run on your Mac, you have to install GCC, which can be obtained by downloading XCode, the smaller command-line tool. Also, we need to install Homebrew, a package manager.

To install Homebrew, open terminal and run the following:

$ ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

After installing Homebrew, you have to insert the Homebrew directory into your PATH environment variable. You can do this by including the following line in your ~/.profile file:

export PATH=/usr/local/bin:/usr/local/sbin:$PATH

Now we are ready to install Python 2.7. Run the following command in your Terminal, which will do the rest:

$ brew install python

To install Sublime Text, go to Sublime Text's downloads page at http://www.sublimetext.com/3, and click on the OS X link. This will get you the Sublime Text installer for your Mac.

Windows does not have Python pre-installed on it. To check if it is installed, open a command prompt and type the word python, and press Enter. In most cases, you will get a message that says Windows does not recognize python as a command.

We have to download an installer that will set Python for Windows. Then we have to install and configure Geany to run Python programs.

Go to Python's download page at https://www.python.org/downloads/windows/ and download the Python 2.7 installer that is compatible with your system. If you are not aware of your operating system's architecture, then download 32-bit installers, which will work on both architectures, but 64-bit will only work on 64-bit systems.

To install Geany, go to Geany's download page at http://www.geany.org/Download/Releases and download the full installer variant, which has a description Full Installer including GTK 2.16. By default, Geany doesn't know where Python resides on your system. So we need to configure it manually.

For that, write a Hello world program in Geany, and save it anywhere in your system as hello.py and run it.

There are three methods you can use to run a Python program in Geany:

When you have a running hello.py program in Geany perform the following steps:

It is recommended to run a Kali Linux distribution as a virtual machine and use this as your scripting environment. Kali Linux comes with a number of tools pre-installed and is based on Debian Linux, so you'll also be able to install a wide variety of additional tools and libraries. Also, some of the libraries will not work properly on Windows systems.

One of the most useful pieces of third-party Python software is Setuptools. With Setuptools, you can download and install any compliant Python libraries with a single command.

The best way to install Setuptools on any system is to download the ez_setup.py file from https://bootstrap.pypa.io/ez_setup.py and run this file with your Python installation.

In Linux, run this in the terminal with the correct path to ez_setup.py script:

$ sudo python path/to/ez_setup.py

For Windows 8, or old versions of Windows with PowerShell 3 installed, start the PowerShell with administrative privileges and run the following command in it:

> (Invoke-WebRequest https://bootstrap.pypa.io/ez_setup.py).Content | python -

For Windows systems without PowerShell 3 installed, download the ez_setup.py file from the preceding link using your web browser and run that file with your Python installation.

Pip is a package management system used to install and manage software packages written in Python. After successful installation of Setuptools, you can install pip by simply opening a command prompt and running the following:

$ easy_install pip

Alternatively, you could also install pip using your default distribution package managers:

    $ sudo apt-get install python-pip

    $ sudo yum install python-pip

Now you could run pip from command line. Try installing a package with pip:

$ pip install packagename

Virtual environments help to separate dependencies required for different projects, by working inside a virtual environment it also helps to keep our global site-packages directory clean.

Using virtualenv and virtualwrapper

Virtualenv is a Python module which helps to create isolated Python environments for our scripting experiments, which creates a folder with all necessary executable files and modules for a basic Python project.

You can install virtualenv with the following command:

    $ sudo pip install virtualenv

To create a new virtual environment, create a folder and enter the folder from the command line:

$ cd your_new_folder 
$ virtualenv name-of-virtual-environment 

This will initiate a folder with the provided name in your current working directory with all Python executable files and pip library, which will then help to install other packages in your virtual environment.

You can select a Python interpreter of your choice by providing more parameters, such as the following command:

$ virtualenv -p /usr/bin/python2.7 name-of-virtual-environment 

This will create a virtual environment with Python 2.7. We have to activate it before starting to use this virtual environment:

$ source name-of-virtual-environment/bin/activate

Now, on the left side of the command prompt, the name of the active virtual environment will appear. Any package that you install inside this prompt using pip will belong to the active virtual environment, which will be isolated from all other virtual environments and global installation.

You can deactivate and exit from the current virtual environment using this command:

$ deactivate

Virtualenvwrapper provides a better way to use virtualenv. It also organizes all virtual environments in one place.

To install, we can use pip, but let's make sure we have installed virtualenv before installing virtualwrapper.

Linux and OS X users can install it with the following method:

$ pip install virtualenvwrapper

Also, add these three lines to your shell startup file, such as .bashrc or .profile:

export WORKON_HOME=$HOME/.virtualenvs 
export PROJECT_HOME=$HOME/Devel 
source /usr/local/bin/virtualenvwrapper.sh 

This will set Devel folder in your home directory as the location of your virtual environment projects.

For Windows users, we can use another package: virtualenvwrapper-win. This can also be installed with pip:

$ pip install virtualenvwrapper-win

To create a virtual environment with virtualwrapper:

$ mkvirtualenv your-project-name

This creates a folder with the provided name inside ~/Envs.

To activate this environment, we can use the workon command:

$ workon your-project-name

This two commands can be combined with the single one as follows:

$ mkproject your-project-name

We can deactivate the virtual environment with the same deactivate command in virtualenv. To delete a virtual environment, we can use the following command:

$ rmvirtualenv your-project-name

Python is brilliant in case of variables. Variables point to data stored in a memory location. This memory location may contain different values, such as integers, real numbers, Booleans, strings, lists, and dictionaries.

Python interprets and declares variables when you set some value to this variable. For example, if we set a = 1 and b = 2.

Then we print the sum of these two variables with:

print (a+b) 

The result will be 3 as Python will figure out that both a and b are numbers.

However, if we had assigned a = "1" and b = "2". Then the output will be 12, since both a and b will be considered as strings. Here, we do not have to declare variables or their type before using them as each variable is an object. The type() method can be used to get the variable type.

As with any other programming language, strings are one of the important things in Python. They are immutable. So, they cannot be changed once defined. There are many Python methods which can modify strings. They do nothing to the original one, but create a copy and return after modifications. Strings can be delimited with single quotes, double quotes, or in case of multiple lines, we can use triple quotes syntax. We can use the \ character to escape additional quotes which come inside a string.

Commonly used string methods are as follows:

Also, we can get the number of characters, including white spaces, in a string with the len() method:

#!/usr/bin/python 
a = "Python" 
b = "Python\n" 
c = "Python  " 
 
print len(a) 
print len(b) 
print len(c) 

You can read more about the string function here: https://docs.python.org/2/library/string.html.

Lists allow us to store more than one variable inside it and provide a better method for sorting arrays of objects in Python. They also have methods which help to manipulate the values inside them:

list = [1,2,3,4,5,6,7,8] 
print (list[1])  

This will print 2, as Python index starts from 0. To print out the whole list, use the following code:

list = [1,2,3,4,5,6,7,8]
for x in list:
 print (x)

This will loop through all elements and print them.

Useful list methods are as follows:

A Python dictionary is a storage method for key:value pairs. Python dictionaries are enclosed in curly braces, {}. For example:

dictionary = {'item1': 10, 'item2': 20} 
print(dictionary['item2']) 

This will output 20. We cannot create multiple values with the same key. This will overwrite the previous value of the duplicate keys. Operations on dictionaries are unique. Slicing is not supported in dictionaries.

We can combine two distinct dictionaries to one by using the update method. Also, the update method will merge existing elements if they conflict:

a = {'apples': 1, 'mango': 2, 'orange': 3} 
b = {'orange': 4, 'lemons': 2, 'grapes ': 4} 
a.update(b) 
 
Print a 

This will return the following:

{'mango': 2, 'apples': 1, 'lemons': 2, 'grapes ': 4, 'orange': 4} 

To delete elements from a dictionary we can use the del method:

del a['mango'] 
print a 

This will return the following:

{'apples': 1, 'lemons': 2, 'grapes ': 4, 'orange': 4}

Sockets are the basic blocks behind all network communications by a computer. All network communications go through a socket. So, sockets are the virtual endpoints of any communication channel that takes place between two applications which may reside on the same or different computers.

The socket module in Python provides us a better way to create network connections with Python. So to make use of this module, we have to import this in our script:

import socket 
socket.setdefaulttimeout(3) 
newSocket = socket.socket() 
newSocket.connect(("localhost",22)) 
response = newSocket.recv(1024) 
print response 

This script will get the response header from the server. We will discuss more about networking in our later chapters.

Even though we wrote syntactically correct scripts, there will be some errors while executing them. So, we have to handle the errors properly. The simplest way to handle exceptions in Python is by using try-except:

Try to divide a number by zero in your Python interpreter:

>>> 10/0
Traceback (most recent call last):
 File "<stdin>", line 1, in <module>
ZeroDivisionError: integer division or modulo by zero

So, we can rewrite this script with try-except blocks:

try: 
   answer = 10/0 
except ZeroDivisionError, e: 
   answer = e 
print answer 

This will return the error integer division or modulo by zero.