In today’s time and day, we live, enjoy, thrive, and even excel because of technology. It is almost impossible to think about our day-to-day life without technology. Most of the technological advancements are thanks to software. Developers or programmers write various programs to create usable software applications. I can rewrite the first statement as, in today’s time and day, we live, enjoy, thrive, and even excel because of the programmers.
I started my career as a software developer in the 90s. Programming was considered a tedious task at the time because programmers had to know some complicated languages and tools. And those tools were slow and not very user friendly. Kicking off the Lint and compiling commands on my C programs automatically triggered the coffee break!
Levels of Programming Languages
Microprocessors are the heart of any digital device. To make the device/hardware work the way we want, we must provide instructions to the microprocessors. The problem is that microprocessors understand the machine language. The machine language (object code) is a series of binary bytes. It is almost impossible to program (and read if needed) in machine language. To solve this problem, assembly language was invented. The assembly language is easy to program since it uses commands in English (and not in binary like machine language). An assembler is used to convert the assembly language into machine language. The assembly language is hardware specific and is not portable between the processors. The assembly language is a “Low Level” language.
The next level up is the compiled languages. C programming language is an excellent example of a compiled language. Programs for microcontrollers can be written in C, and the compiler can translate them into the machine language. Programmers can write programs in C that are for targeted microcontrollers. These programs can be compiled on desktops/laptops and tested before flashing into the processor. The compiled language offers flexibility, portability, and ease of writing and debugging to programmers. C++, Java, etc., are also examples of high level programming languages.
Python
The hero of our story, Python, takes this flexibility and ease of writing to the next level. Python is a high level, interpreted programming language that is simple for programmers to write and understand the written code. Python provides numerous built-in libraries that make object-oriented and functional programming easy.
Python for Cybersecurity
The simplicity and flexibility of Python attract cybersecurity professionals. Python has ready-to-use cybersecurity libraries that allow programmers to implement most security protocols without effort.
Python also supports NIST and FIPS approved libraries, enabling programmers to implement compliant code. Moreover, Python offers libraries that allow seamless integration with some of the most popular cybersecurity testing tools, such as Nmap, Pwntools, and YARA.
Python's ease of use and portability enable cybersecurity professionals to use Python for almost everything – from Penetration testing and log/forensic analysis to automation.
Python is easy to use and learn. If you are learning Python or planning to use Python within the field of cybersecurity, you must know, at the least, the following Python libraries.
REQUESTS
The official website defines Requests as “An elegant and simple HTTP library for Python, built for human beings.” Requests is one of the most popular Python libraries. It is famous for sending the HTTP requests and handling the response.
REQUESTS is primarily used to automate security testing and vulnerability detection. Its ability to APIs helps cybersecurity professionals in testing weak API security.
SCAPY
Testing network security is one of the most important tasks for a penetration tester. Packets are at the heart of the network traffic. Penetration Testers can use SCAPY to process, decode, forge, and analyze packet information. Penetration testers can use SCAPY to create malicious payloads or payloads customized for test cases. SCAPY is also a popular library with law and enforcement as it can be used for forensic investigation. SCAPY can also be used to scan the network for open ports.
PyCrypto
Cryptography is the heart of the security. Cryptography is used for integrity, confidentiality, authenticity, and non-repudiation. Python’s PyCrypto library makes it easy for developers to secure the data at rest and in transit.
PyCrypto library makes various cryptographic functions such as encryption, decryption, hashing, and digital signature very easy to implement and reduces the chances of human error in implementation. PyCrypto supports various Symmetric (AES, DES) and Asymmetric (RSA) algorithms, hash functions, and digital signature algorithms (DSA, RSA).
Nmap
Python Nmap module or library allows developers to integrate the Nmap tool easily with Python. Nmap is a free, open source network scanning and analyzing tool. Most penetration testers cannot live without Nmap. Security testers can use the Python Nmap library to automate testing, scan networks, discover hosts, and perform various other security testing.
YARA
YARA, Yet Another Ridiculous Acronym, is a rule based, pattern detection tool. It benefits security testers in malware identification, analysis, and classification. Python’s YARA library makes using the YARA features in the testing easy. The library can easily extract the data that matches the YARA criteria from the application being tested.
PWNTOOLS – an honorable mention.
Although PWNTOOLS is not considered a core Python library for every cybersecurity professional, it is a must for a red teamer. The official documentation describes PWNTOOLS as “A CTF framework and exploits development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.”
