Preface
Python hacker. Those are two words you really could use to describe me. At Immunity, I am lucky
enough to work with people who actually, really, know how to code Python. I am not one of those
people. I spend a great deal of my time penetration testing, and that requires rapid Python tool
development, with a focus on execution and delivering results (not necessarily on prettiness,
optimization, or even stability). Throughout this book you will learn that this is how I code, but I also
feel as though it is part of what makes me a strong pentester. I hope that this philosophy and style
helps you as well.
As you progress through the book, you will also realize that I don鈥檛 take deep dives on any single
topic. This is by design. I want to give you the bare minimum, with a little flavor, so that you have
some foundational knowledge. With that in mind, I鈥檝e sprinkled ideas and homework assignments
throughout the book to kickstart you in your own direction. I encourage you to explore these ideas, and
I would love to hear back any of your own implementations, tooling, or homework assignments that
you have done.
As with any technical book, readers at different skill levels with Python (or information security in
general) will experience this book differently. Some of you may simply grab it and nab chapters that
are pertinent to a consulting gig you are on, while others may read it cover to cover. I would
recommend that if you are a novice to intermediate Python programmer that you start at the beginning
of the book and read it straight through in order. You will pick up some good building blocks along
the way.
To start, I lay down some networking fundamentals in Chapter 2 and slowly work our way through
raw sockets in Chapter 3 and using Scapy in Chapter 4 for some more interesting network tooling.
The next section of the book deals with hacking web applications, starting with your own custom
tooling in Chapter 5 and then extending the popular Burp Suite in Chapter 6. From there we will
spend a great deal of time talking about trojans, starting with GitHub command and control in
Chapter 7, all the way through Chapter 10 where we will cover some Windows privilege escalation
tricks. The final chapter is about using Volatility for automating some offensive memory forensics
techniques.
I try to keep the code samples short and to the point, and the same goes for the explanations. If you are
relatively new to Python I encourage you to punch out every line to get that coding muscle memory
going. All of the source code examples from this book are available at
http://nostarch.com/blackhatpython/.
