Cyber Security - Python and Web Applications

Demonstrate a python-based penetration testing workflow by sending requests, evaluating status codes, and probing for admin panels and potential vulnerabilities on a simple web site.

Explore a simple Python example that dumps environment variables to a dict, converts to JSON, and posts secrets to a server to simulate botnet data collection and phoning home.

Understand how code exploits enable remote or local unauthorized code execution and data access, and examine zero days, bug bounty programs, and the Madis ploy framework.

Learn how a code exploit can overflow buffers by feeding a binary file of crafted bytes using Python, revealing how garbage data can leak passwords when the file is processed.

Stay informed about vulnerabilities and patches, apply timely updates, test systems after patches, and use authorized sources with multi-factor authentication to prevent exploits.

Maintain regular backups and tamper-proof audit trails, including access logs, to prevent the need for forensic investigation and to reconstruct past events for compliance.

Explore network traffic analysis with a Python code example using scapy to sniff packets on a specified interface, print packet summaries, and run with administrator privileges.

Explore how wireless connectivity relates to cybersecurity, covering wardriving, rogue access points, and the risks of zero physical access and default credentials.

Demonstrates web reconnaissance with Python by fetching a domain via requests, detecting SSL, stylesheets, and JavaScript, and cataloging results into a JSON profile with a unique digest.

Examine how a simple Python command can be concealed with base64 encoding and obfuscated code to bypass antivirus checks, including writing and evaluating decoded content.

Explore antivirus evasion remediation by updating virus definitions, applying signatures across devices, and integrating a security tool suite with firewalls, authentication, and monitoring to prevent and detect malicious code.

Build a Python security tool named Achilles with a command line interface, using argument parsing, input validation, and HMO document parsing to perform vulnerability analysis and output a report.

Parse HTML documents served by a local http server using urllib.parse and BeautifulSoup, inspect forms with find_all, and assess elements for vulnerability reporting.

Generate a report from our analysis by flagging non-secure forms in the document. Print the issue report for form vulnerabilities and prepare for the next check.

Understand how to test a Python security tool with integration testing, treating it as a black-box by feeding inputs and validating outputs, including error conditions on the command line.

Explain how command injection exploits rely on unsanitized input to execute code on a server, often targeting Linux-based systems with Java, AWS, Red Hat, and other stacks.

Demonstrates command injection in a Rails app by showing unsanitized input triggering os commands, and explains stopping it by sanitizing input and applying a character blacklist.

Examine SQL injection as a common vulnerability from unsanitized inputs and poorly structured queries. Learn how proper query discipline and input sanitization protect databases in web apps.

Explain sql injection in rails by showing how unsafely built queries can return all users, and demonstrate fixing it with parameterized queries.

Examine broken authentication and how password complexity shapes security, highlighting risks of weak or reused passwords across systems and legacy eight-character or restricted rules in web applications.

Explore password complexity and how weak passwords create a vulnerability in sign up forms, as the PHP example shows length checks and rules to enforce longer, more complex passwords.

illustrates information leakage in authentication with a Rails login example, showing how specific messages reveal username or password errors and how generic failure messages remediate security risk.

Protect sensitive data by preventing information leakage, enforcing encryption, and restricting data returned to users to avoid exposing passwords, cookies, or personal records.

Examine xml external entities (XXE) vulnerabilities where external entities load local files, exposing sensitive data; learn to defend by disabling external entity loading and scanning inputs for patterns.

Identify and prevent broken access control by enforcing proper authorization rules, guarding against manipulated requests and role-based access, to protect sensitive data and avoid data leaks.

Explore how security misconfiguration affects any web app stack—from data layers to gateways—through insecure defaults, unnecessary features, and outdated software, and how to harden with proper configuration.

Demonstrate how insecure deserialization in a PHP example lets an attacker tamper with cookies and gain admin rights by manipulating user data, and suggest encrypting and separating cookies.

Understand data breaches, their causes, and downstream effects, and learn practical strategies such as data retention policy, encryption, intrusion detection, and clear communication plans to mitigate exposure.

Build a Python password hashing tool for secure storage and authentication. Learn why plain-text passwords are unsafe, and how salted hashing prevents recovery while still allowing login checks.

Check the python version, create a folder called incorruption, write a python file with a shebang, make it executable, and run it from the command line to print hello.

Learn to build a Python command line tool with argparse and pip, define a version, add a required password argument, parse inputs, and test printing before adding encryption logic.

Evaluate a Python password hashing tool by printing the encrypted password and validating it with a check password function to confirm the encrypted and original passwords match, ensuring secure storage.