Cyber Security - Python and Web Applications

Demonstrate a python-based penetration testing workflow by sending requests, evaluating status codes, and probing for admin panels and potential vulnerabilities on a simple web site.

Explore remediation in penetration testing with honeypots that trap attackers and network delays that slow suspicious activity, plus traffic masking to mislead attackers while preserving legitimate tests.

Build a simple port scanner in Python using the socket library, check ports with zero return codes, and log open or closed results while noting legal cautions.

Configure firewalls to hide open ports and enforce a white list, disable unused services like telnet and mail, and modify banners to mislead port scanners.

Explore a simple Python example that dumps environment variables to a dict, converts to JSON, and posts secrets to a server to simulate botnet data collection and phoning home.

Understand how code exploits enable remote or local unauthorized code execution and data access, and examine zero days, bug bounty programs, and the Madis ploy framework.

Learn how a code exploit can overflow buffers by feeding a binary file of crafted bytes using Python, revealing how garbage data can leak passwords when the file is processed.

Stay informed about vulnerabilities and patches, apply timely updates, test systems after patches, and use authorized sources with multi-factor authentication to prevent exploits.

Explore computer forensics in cybersecurity by recovering data from hardware, memory, and storage, reconstructing event timelines, and analyzing logs and device data as evidence.

Maintain regular backups and tamper-proof audit trails, including access logs, to prevent the need for forensic investigation and to reconstruct past events for compliance.

Explore network traffic analysis with a Python code example using scapy to sniff packets on a specified interface, print packet summaries, and run with administrator privileges.

Explore how wireless connectivity relates to cybersecurity, covering wardriving, rogue access points, and the risks of zero physical access and default credentials.

Address wireless vulnerabilities by hiding SSIDs, separating guest and internal networks, and changing default credentials. Implement WPA and WPA2, and apply MAC address filtering to harden the network.

Demonstrates web reconnaissance with Python by fetching a domain via requests, detecting SSL, stylesheets, and JavaScript, and cataloging results into a JSON profile with a unique digest.

Examine how a simple Python command can be concealed with base64 encoding and obfuscated code to bypass antivirus checks, including writing and evaluating decoded content.

Explore antivirus evasion remediation by updating virus definitions, applying signatures across devices, and integrating a security tool suite with firewalls, authentication, and monitoring to prevent and detect malicious code.

Build a Python security tool named Achilles with a command line interface, using argument parsing, input validation, and HMO document parsing to perform vulnerability analysis and output a report.

Learn how to manage Python dependencies with pip, install packages via Python 3, and handle admin permissions while using popular packages like Django, requests, and validators.

Learn to implement argument parsing in Python by creating a parser, adding version and URL arguments, understanding short flags and usage output, and distinguishing required versus optional arguments.

Parse HTML documents served by a local http server using urllib.parse and BeautifulSoup, inspect forms with find_all, and assess elements for vulnerability reporting.

Generate a report from our analysis by flagging non-secure forms in the document. Print the issue report for form vulnerabilities and prepare for the next check.

Add a second check to detect secrets in file comments using BeautifulSoup and a lambda function, reporting hidden keys without printing the comments.

Analyze a demo security page by checking HTML forms for plain text password fields and verify password inputs use the proper password type to prevent exposure.

Improve the report by validating empty reports, printing secure messages when no issues exist, and generating a vulnerability report for found issues, while preparing for configurable output.

Load YAML config files with the yemo library, converting streams or strings into Python objects. Override a default config with file values and merge conflicts to ensure correct settings.

Learn how to add a file output option for reports in a Python command-line tool, including a new flag, file path handling, opening for writing, and constructing the report header.

Understand how to test a Python security tool with integration testing, treating it as a black-box by feeding inputs and validating outputs, including error conditions on the command line.

Create usage documentation for your tool with a markdown readme on GitHub, and generate docs using pydoc, docstrings, Sphinx, and reStructuredText hosted on Read the Docs.

Explore why web application security matters in a browser-based, common-technology world. Learn how input creates attack surfaces and how the open web application security project's top 10 risks guide protection.

Explore the OWASP top 10 vulnerabilities, understand why they are dangerous, review Rails examples, and identify injection types and broken authentication subcategories.

Explore the Ruby on Rails framework with its beginner-friendly design and built-in features, and examine top 10 vulnerabilities in a Rails app with security focus and bounty program.

Explore PHP's role in the web, from the lamp stack to WordPress, Drupal, and MediaWiki. Assess its beginner-friendly nature and the security considerations of its many configurable surfaces.

Explain how command injection exploits rely on unsanitized input to execute code on a server, often targeting Linux-based systems with Java, AWS, Red Hat, and other stacks.

Demonstrates command injection in a Rails app by showing unsanitized input triggering os commands, and explains stopping it by sanitizing input and applying a character blacklist.

Explore how command injection arises in a PHP workflow through input-driven exec calls and string concatenation. Learn to remediate with escape shell command techniques to prevent leaking confidential output.

Examine SQL injection as a common vulnerability from unsanitized inputs and poorly structured queries. Learn how proper query discipline and input sanitization protect databases in web apps.

Explain sql injection in rails by showing how unsafely built queries can return all users, and demonstrate fixing it with parameterized queries.

Explore how PHP data objects (PDO) enable prepared queries, bind variables to placeholders, and scrub inputs to prevent SQL injection in PHP applications.

Examine broken authentication and how password complexity shapes security, highlighting risks of weak or reused passwords across systems and legacy eight-character or restricted rules in web applications.

Explore password complexity and how weak passwords create a vulnerability in sign up forms, as the PHP example shows length checks and rules to enforce longer, more complex passwords.

illustrates information leakage in authentication with a Rails login example, showing how specific messages reveal username or password errors and how generic failure messages remediate security risk.

Explain how information leakage arises in a PHP login page on a local server, review conditional responses, and fix with generic errors to avoid revealing which credential failed.

Protect sensitive data by preventing information leakage, enforcing encryption, and restricting data returned to users to avoid exposing passwords, cookies, or personal records.

Identify and fix sensitive data exposure in a Rails app by removing password visibility from index, edit, login, and new user views to prevent information leakage.

Explore the xml external entities (xxe) vulnerability, where external entity references are evaluated during xml processing, risking malicious input and remote code execution in web apps.

Explore how Rails defaults can enable XML external entities (XXE) attacks that expose secrets, and prevent it by turning off parsing by default and validating content with safe libraries.

Examine xml external entities (XXE) vulnerabilities where external entities load local files, exposing sensitive data; learn to defend by disabling external entity loading and scanning inputs for patterns.

Identify and prevent broken access control by enforcing proper authorization rules, guarding against manipulated requests and role-based access, to protect sensitive data and avoid data leaks.

Explore how broken access control exposes admin functionality when authorization isn't done correctly. See why server-side authorization and true user-based checks prevent access, avoiding client-side flags and insecure serializations.

Explore how security misconfiguration affects any web app stack—from data layers to gateways—through insecure defaults, unnecessary features, and outdated software, and how to harden with proper configuration.

Explore cross-site scripting (xss) as a vulnerability where unsanitized user input can execute javascript, reflected or stored, leading to malicious information and clickjacking.

Explore insecure deserialization vulnerabilities in modern web apps, where unsanitized input stored in serialized formats is evaluated as code, risking remote execution.

Demonstrate how insecure deserialization in a PHP example lets an attacker tamper with cookies and gain admin rights by manipulating user data, and suggest encrypting and separating cookies.

Explain how multi-factor authentication uses something you know, something you have, or something you are to prevent breaches, using smartphone authenticator apps and one-time passcodes.

Explore ethical hacking as white hat security research, focusing on vulnerability discovery and responsible disclosure. Learn how ethical hackers test systems to prevent breaches and protect user data.

Explore how physical security complements digital safeguards through access controls, surveillance, intrusion detection, and biometrics, with disaster protection and ethical hacking practices.

Understand data breaches, their causes, and downstream effects, and learn practical strategies such as data retention policy, encryption, intrusion detection, and clear communication plans to mitigate exposure.

Explore cloud security as organizations move to public and hybrid cloud models, focusing on identity and access management, role-based policies, logging, monitoring, and automated defense.

Master a command-line password encryption tool in python that hashes a password with salt, generating a random hash for secure storage.

Build a Python password hashing tool for secure storage and authentication. Learn why plain-text passwords are unsafe, and how salted hashing prevents recovery while still allowing login checks.

Check the python version, create a folder called incorruption, write a python file with a shebang, make it executable, and run it from the command line to print hello.

Learn to build a Python command line tool with argparse and pip, define a version, add a required password argument, parse inputs, and test printing before adding encryption logic.

Evaluate a Python password hashing tool by printing the encrypted password and validating it with a check password function to confirm the encrypted and original passwords match, ensuring secure storage.