Python for Cyber Security Course

Lesson 1 • File I/O and Data Serialization

Read, write, and parse files including JSON, CSV, and plain text. Security tools constantly ingest and produce structured data files.

Lesson 2 • Core Python Syntax and Data Types

Cover variables, operators, strings, integers, lists, dicts, and sets. These primitives underpin every script written in later chapters.

Lesson 3 • Functions, Modules, and Libraries

Define reusable functions and import standard library modules. Modular design keeps security scripts maintainable and testable.

Lesson 4 • Control Flow and Logic

Apply conditionals, loops, and exception handling to control program execution. Logical branching is essential for writing decision-driven security tools.

Lesson 1 • Port Scanning with Python

Implement threaded TCP port scanners and interpret results. Port scanning is a foundational reconnaissance skill for penetration testers.

Lesson 2 • Python Socket Programming Basics

Create TCP and UDP sockets, bind addresses, and transfer data. Socket primitives are the foundation of all custom network tools built later.

Lesson 3 • TCP/IP and OSI Model Essentials

Map the OSI and TCP/IP layers to real packet behavior. This context is required before writing any network-aware security tool.

Lesson 4 • Working with Scapy for Packet Crafting

Craft, send, and sniff custom packets using Scapy. Packet-level control enables advanced probing and protocol analysis tasks.

Lesson 1 • Hashing and Message Integrity

Compute MD5, SHA-256, and HMAC digests with Python's hashlib. Integrity verification is used in file auditing and authentication workflows.

Lesson 2 • Cryptography Fundamentals Review

Contrast symmetric, asymmetric, and hash-based schemes with concrete examples. This conceptual grounding prevents misapplication of algorithms in later sections.

Lesson 3 • Asymmetric Encryption and RSA

Generate RSA key pairs, encrypt messages, and sign data programmatically. Public-key operations secure key exchange and identity verification.

Lesson 4 • Symmetric Encryption with AES

Encrypt and decrypt data using AES-CBC and AES-GCM modes via the cryptography library. Authenticated encryption prevents both eavesdropping and tampering.

Lesson 1 • DNS Enumeration and Subdomain Discovery

Query DNS records and brute-force subdomains using dnspython. DNS enumeration reveals the attack surface of a target organization.

Lesson 2 • Web Scraping with Requests and BeautifulSoup

Fetch web pages and parse HTML to extract structured data. Scraping automates manual OSINT collection at scale.

Lesson 3 • Building an Automated OSINT Report

Combine DNS, WHOIS, and API data into a formatted HTML or PDF report. Automated reporting converts raw data into actionable intelligence deliverables.

Lesson 4 • WHOIS and Certificate Transparency

Retrieve WHOIS registration data and parse certificate transparency logs. These sources expose infrastructure ownership and hidden subdomains.

Lesson 1 • Web Application Vulnerability Detection

Detect SQL injection, XSS, and directory traversal flaws with custom Python scripts. Web vulnerabilities remain the most prevalent attack vector in modern environments.

Lesson 2 • Integrating Nmap with Python

Drive Nmap scans from Python using python-nmap and parse XML output. Programmatic Nmap control enables automated, repeatable vulnerability discovery.

Lesson 3 • Exploit Development Fundamentals

Study buffer overflow concepts and write simple shellcode launchers in Python. Exploit fundamentals help analysts understand attacker techniques and patch priorities.

Lesson 4 • Metasploit Integration via Python

Control Metasploit through its RPC API using Python to automate exploit workflows. API-driven exploitation enables repeatable, auditable penetration test procedures.

Lesson 1 • Automating Malware Triage Pipelines

Chain static analysis, sandbox submission, and IOC extraction into a single automated workflow. Triage pipelines reduce analyst workload during high-volume incident response.

Lesson 2 • Dynamic Analysis and Sandbox Interaction

Submit samples to sandbox APIs and parse behavioral reports programmatically. Dynamic analysis reveals runtime behavior invisible to static inspection.

Lesson 3 • Static Analysis of Suspicious Files

Extract strings, hashes, and metadata from binaries without executing them. Static analysis provides safe initial triage before dynamic examination.

Lesson 4 • Disassembly and Code Analysis

Use Capstone and pefile to disassemble binary code and identify suspicious routines. Code-level analysis uncovers obfuscated logic and embedded payloads.

Lesson 1 • Log Parsing and Anomaly Detection

Ingest syslog, Windows Event, and web server logs to identify suspicious patterns. Log analysis is the primary detection method in most security operations centers.

Lesson 2 • Automated Incident Response Playbooks

Encode response actions such as IP blocking and account disabling into Python playbooks. Automated playbooks enforce consistent, auditable responses to common incidents.

Lesson 3 • SIEM Integration and Alert Enrichment

Forward parsed events to SIEM platforms via API and enrich alerts with threat context. Enriched alerts reduce analyst triage time and improve detection accuracy.

Lesson 4 • Network Traffic Analysis with Python

Capture and analyze live or recorded PCAP traffic to detect intrusions. Traffic analysis complements log review by revealing network-layer attack evidence.

Lesson 1 • Concurrency and Performance Optimization

Apply threading, multiprocessing, and async I/O to accelerate security tool execution. High-performance tools complete scans and analyses within operational time constraints.

Lesson 2 • Testing and Quality Assurance for Security Tools

Write unit and integration tests for security scripts using pytest and mock objects. Tested tools behave predictably under adversarial and edge-case conditions.

Lesson 3 • Building Command-Line Security Tools

Design polished CLI interfaces with argparse and rich for professional tool delivery. Well-designed CLIs improve adoption and reduce operator error in field use.

Lesson 4 • Secure Coding Practices in Python

Apply input validation, secrets management, and dependency auditing to security tool code. Secure coding prevents tools themselves from becoming attack vectors.