Another incredible Python book. With a minor tweak or two many of these programs will have at least a ten-year shelf life, and that is rare for a security book.
A great book using Python for offensive security purposes.
If you truly have a hackers mindset, a spark is all you need to make it your own and do something even more a`mazing. Justin Seitz offers plenty of sparks.
Whether youre interested in becoming a serious hacker/penetration tester or just want to know how they work, this book is one you need to read. Intense, technically sound, and eye-opening.
Definitely a recommended read for the technical security professional with some basic previous exposure to Python.
Black Hat Python
2nd Edition
Python Programming for Hackers and Pentesters
by Justin Seitz and Tim Arnold
San Francisco
BLACK HAT PYTHON, 2nd Edition. Copyright 2021 by Justin Seitz and Tim Arnold .
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher.
ISBN-13: 978-1-7185-0112-6 (print)
ISBN-13: 978-1-7185-0113-3 (ebook)
Publisher: William Pollock
Executive Editor: Barbara Yien
Production Editor: Dapinder Dosanjh
Developmental Editor: Frances Saux
Cover Illustration: Garry Booth
Interior Design: Octopod Studios
Technical Reviewer: Cliff Janzen
Copyeditor: Bart Reed
Compositor: Jeff Lytle, Happenstance Type-O-Rama
Proofreader: Sharon Wilkey
For information on book distributors or translations, please contact No Starch Press, Inc. directly:
No Starch Press, Inc.
245 8th Street, San Francisco, CA 94103
phone: 1-415-863-9900; info@nostarch.com
www.nostarch.com
Library of Congress Control Number: 2014953241
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark.
The information in this book is distributed on an As Is basis, without warranty. While every precaution has been taken in the preparation of this work, neither the authors nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it.
To my beautiful wife, Clare. I love you.
Justin
About the Authors
Justin Seitz is a renowned cybersecurity and open source intelligence practitioner and the co-founder of Dark River Systems Inc., a Canadian security and intelligence company. His work has been featured in Popular Science, Motherboard, and Forbes. Justin has authored two books on developing hacking tools. He created the AutomatingOSINT.com training platform and Hunchly, an open source intelligence collection tool for investigators. Justin is also a contributor to the citizen journalism site Bellingcat, a member of the International Criminal Courts Technical Advisory Board, and a Fellow at the Center for Advanced Defense Studies in Washington, DC.
Tim Arnold is currently a professional Python programmer and statistician. He spent much of his early career at North Carolina State University as a respected international speaker and educator. Among his accomplishments, he has ensured that educational tools are accessible to underserved communities worldwide, including making mathematical documentation accessible to the blind.
For the past many years, Tim has worked at SAS Institute as a principal software developer, designing and implementing a publishing system for technical and mathematical documentation. He has served on the board of the Raleigh ISSA and as a consultant to board of the International Statistical Institute. He enjoys working as an independent educator, making infosec and Python concepts available to new users and elevating those with more advanced skills. Tim lives in North Carolina with his wife, Treva, and a villainous cockatiel named Sidney. You can find him on Twitter at @jtimarnold.
About the Technical Reviewer
Since the early days of Commodore PET and VIC-20, technology has been a constant companion to Cliff Janzenand sometimes an obsession! Cliff spends a majority of his workday managing and mentoring a great team of security professionals, striving to stay technically relevant by tackling everything from security policy reviews and penetration testing to incident response. He feels lucky to have a career that is also his favorite hobby and a wife who supports him. He is grateful to Justin for including him on the first edition of this wonderful book and to Tim for leading him to finally make the move to Python 3. And special thanks to the fine people at No Starch Press.
Foreword
It has been six years since I wrote the foreword to the very successful first edition of Black Hat Python. Much has changed in the world during this time, but one thing hasnt: I still write an awful lot of Python code. In the field of computer security, you will still come across tools written in a variety of languages, depending on the task. Youll see C code written for a kernel exploit, JavaScript code written for a JavaScript fuzzer, or a proxy written in a newer hipper language like Rust. But Python is still the workhorse in this industry. For my money, it is still the easiest language with which to get started, and with the large number of libraries available, it is the best language for quickly writing code to perform complex tasks in a simple way. The majority of computer security tools and exploits are still written in Python. This includes everything from exploit frameworks like CANVAS to classic fuzzers like Sulley.
Prior to the publication of the first edition of Black Hat Python, I had written many fuzzers and exploits in Python. These included exploits against Safari for Mac OS X, iPhone and Android phones, and even Second Life. (You may have to Google that last one.)
Anyway, since then, Ive written a pretty special exploit, with help of Chris Valasek, that was able to remotely compromise a 2014 Jeep Cherokee and other cars. Of course, this exploit was written in Python, using the dbus-python module. All of the tools we wrote, which eventually allowed us to remotely control the steering, brakes, and acceleration of the compromised vehicle, were also written in Python. You could say, in a way, that Python was responsible for the recall of 1.4 million Fiat Chrysler vehicles.
If you are interested in tinkering with information security tasks, Python is a great language to learn because of the large number of reverse engineering and exploitation libraries available for your use. Now, if only the Metasploit developers would come to their sense and switch from Ruby to Python, our community would be united.