Black Hat Python
Python Programming for Hackers and Pentesters
In-Person 4 Days Training ★ February 2024
FEB 20-23 // DETAILED SCHEDULE READY
This is the official companion course to the popular book Black Hat Python, 2nd Edition from No Starch Press. This companion course has been updated for Python 3 and developed under the oversight and cooperation of the original Black Hat Python author Justin Seitz. The course aims to cover the major subject areas from Black Hat Python 2nd Edition in a hands-on format where students will learn by working on an extensive suite of labs and exercises in a guided manner to make the most of our time together. This course will be beneficial for students that are seasoned Python programmers as well as those newer to the field.
Only a basic understanding of Python is required to participate in the course. Students will be provided with a brief Python language basics tutorial that they can go through on their own prior to starting the course.
Key Learning Objectives
- Python basics and environment setup
- Basic Networking Tools
- Writing a Sniffer
- Owning the Network with Scapy
- Web Hackery
- Extending Burp Proxy
- Creating a Command and Control Framework
- Common Trojaning Tasks on Windows
- Data Exfiltration
- Privilege Escalation
Intended Audience
- Penetration testers and hackers wanting to write custom tools and up their game with Python coding!
Detailed Agenda
1 SETTING UP YOUR PYTHON ENVIRONMENT
- Installing Kali Linux
- Setting Up Python
- Installing an IDE
- Code Hygiene
2 BASIC NETWORKING TOOLS
- TCP Client
- UDP Client
- TCP Server
- Replacing Netcat
- Building a TCP Proxy
- SSH with Paramiko
- SSH Tunneling
3 WRITING A SNIFFER
- Python Building a UDP Host Discovery Tool
- Packet Sniffing on Windows and Linux
- Decoding the IP Layer
- The ctypes Module
- The struct Module
- Writing the IP Decoder
- Decoding ICMP
4 OWNING THE NETWORK WITH SCAPY
- Stealing Email Credentials
- ARP Cache Poisoning with Scapy
- PCAP Processing
5 WEB HACKERY
- Using Web Libraries
- The urllib Library for Python 3 .x
- The requests Library
- The lxml and BeautifulSoup Packages
- Mapping Open-Source Web App Installations
- Mapping the WordPress Framework
- Testing the Live Target
- Brute-Forcing Directories and File Locations
- Kicking the Tires
- Brute-Forcing HTML Form Authentication
6 EXTENDING BURP PROXY
- Setting Up
- Burp Fuzzing
- Using Bing for Burp
- Turning Website Content into Password Gold
7 GITHUB COMMAND AND CONTROL
- Setting Up a GitHub Account
- Creating Modules
- Configuring the Trojan
- Building a GitHub-Aware Trojan
- Hacking Python’s import Functionality
8 COMMON TROJANING TASKS ON WINDOWS 127
- Keylogging for Fun and Keystrokes
- Taking Screenshots
- Pythonic Shellcode Execution
- Sandbox Detection
9 FUN WITH EXFILTRATION
- Encrypting and Decrypting Files
- Email Exfiltration
- File Transfer Exfiltration
- Exfiltration via a Web Server
- Putting It All Together
10 WINDOWS PRIVILEGE ESCALATION
- Installing the Prerequisites
- Creating the Vulnerable BlackHat Service
- Creating a Process Monitor
- Process Monitoring with WMI
- Windows Token Privileges
- Winning the Race
- Code Injection
Knowledge Prequisites
Only a basic understanding of Python is required to participate in the course. Students will be provided with a brief Python language basics tutorial that they can go through on their own prior to starting the course.
Hardware Requirements
- A laptop with 8GB of RAM capable of running VMWare images provided by the course instructor
- 20GB of free hard disk space
Software Requirements
- Students will be responsible for installing a Python 3 language environment on their laptop using directions provided by the course instructor
- Students will need to have VMWare workstation (trial version will be fine) in order to run VMWare images produced with the latest version of the software
- Students should have administrative access on their laptop and the ability to disable antivirus and other security software
Karim Nathoo
Karim Nathoo is a freelance computer security consultant providing specialized security services to government, military and private sector clients. Karim has extensive experience in high assurance ethical hacking, incident response and security product evaluation, including the application of binary code analysis and reverse engineering. Karim has delivered professional services for international clients in Asia, Europe, Canada and the United States. Karim has experience ranging from working with R&D teams in cutting edge technical environments to providing executive level risk management briefings and proof of concept demonstrations.
Karim has performed security assurance and engineering engagements for organizations such as Apple, Microsoft, France Telecom, Cloakware Corporation, Creative Labs, Motorola, Verizon, Nokia, Philips Semiconductor, SONY BMG, SUN Microsystems, QNX Software Systems and numerous Canadian and US Government agencies.
Specialities: Penetration testing, code analysis, reverse engineering, software security evaluation, custom software development, malware analysis, incident response, product evaluation, and security engineering.
SPONSORS
