A one-month, lab-driven course on writing Python that does security work — from language fundamentals and the standard library, through OOP, concurrency, and packaging, to building port scanners, log analysers, and reconnaissance tooling you can actually run. Learn the language, then build the tools.
| Property | Value |
|---|---|
| Course Title | Python for Security Professionals |
| Folder | Python-for-Security-Professionals/ |
| Tag | Python for Security |
| Slug | python-hack |
| Level | Beginner to Advanced |
| Duration | 1 Month (4 Weeks · 1 Hour/Day · ~30 Hours) |
| Focus | Security Automation & Tooling |
| Reference Runtime | Python 3.11 · Python 3.12 · Python 3.13 |
| Modules | 14 |
| Delivery | Self-paced notes + hands-on labs |
| Language | English |
Note
What this course is
A study-and-practice track built as an Obsidian knowledge base. Each module is a folder with its own Readme hub and a set of single-topic notes containing tagged, copy-ready Python and shell snippets. It is designed to be read in order but is fully cross-linked for reference use.
Warning
Authorized use only
Every scanning, enumeration, and exploitation example in this course targets 127.0.0.1, a lab VM you control, scanme.nmap.org, or synthetic data. Run them only against systems you own or are explicitly authorized to test. Automated scanning is loud, easily logged, and unlawful in most jurisdictions without written permission. Exploit-development material is deliberately conceptual and lab-scoped.
Master Python end to end for security work: the language core and its data model, functions and object-orientation, file handling and error resilience, the standard library and packaging, then the advanced material that real tooling depends on — generators, dataclasses, concurrency, and regular expressions.
The program then turns that foundation into practice. The final two modules and every lab and project build working software: a threaded port scanner, a brute-force detector, a file-integrity monitor, a subdomain enumerator, and a hash identifier. Each is written the way a maintainable tool should be — engine separated from interface, timeouts and error handling everywhere, structured output, and an authorization check in the code rather than the README.
The Python for Security Professionals program provides practical, job-ready skills across the Python language, the standard library, and security automation. It assumes no prior programming experience and progresses to building and packaging real security tools.
By the end of the course, students will be able to:
- Write clean, PEP 8 Python 3 with type hints and meaningful error handling
- Choose the right built-in type and container for a given task
- Structure code with functions, classes, modules, and installable packages
- Read and write files, CSV, and JSON safely, including untrusted paths
- Handle network, parsing, and API failures without crashing a long-running scan
- Use the standard library for sockets, TLS, hashing, and credential generation
- Apply threads to I/O-bound work and processes to CPU-bound work, and explain why
- Parse logs at scale with compiled regular expressions and
collections - Build reconnaissance and enumeration tooling with an authorization check in code
- Package a tool with
pyproject.tomland a console entry point - Test security tooling with the network mocked
Tip
Learn the language through the tools Security is not bolted on at the end. From Module 2 onward every example parses scan output, hashes a file, or filters a host list — so the language is learned in the context it will actually be used.
The 14 modules are sequenced into seven progressive stages. Complete each stage before advancing; the automation and tooling stages assume the standard library and error handling from earlier stages.
Stage 1 Foundations .................. Environment Setup · Objects & Data Structures
Stage 2 Logic & Control Flow ......... Comparison Operators · Statements & Control Flow
Stage 3 Functions & Objects .......... Methods & Functions · Object-Oriented Programming
Stage 4 Data & Resilience ............ Input/Output File Handling · Error & Exception Handling
Stage 5 The Standard Library ......... Modules & Packages · Built-in Functions · Advanced Modules
Stage 6 Advanced Python .............. Advanced Data Structures
Stage 7 Security Automation & Tooling Automation for Security · Security Tool Development
flowchart LR
A[Foundations] --> B[Logic & Control Flow]
B --> C[Functions & Objects]
C --> D[Data & Resilience]
D --> E[The Standard Library]
E --> F[Advanced Python]
F --> G[Security Automation & Tooling]
G --> H[Labs · Projects]
Important
Prerequisite chaining The Security Automation stage (Stage 7) depends on the Standard Library (Stage 5) and Data & Resilience (Stage 4). Attempting the scanner, log-parser, or enumeration labs without sockets, concurrency, and exception handling will leave gaps in both the tool and the reasoning behind it.
| Requirement | Level | Notes |
|---|---|---|
| Basic computer literacy | Required | Installing software, navigating a filesystem |
| Command-line familiarity | Recommended | Running python3 and pip from a terminal |
| Networking fundamentals | Recommended | TCP/IP, ports, DNS, HTTP — reinforced in-course |
| Prior programming experience | Not required | The course starts from language fundamentals |
| A Linux machine or VM | Required | Kali, Debian, Ubuntu, or Fedora; macOS and WSL also work |
| A disposable lab target | Required for Stage 7 | A local VM or container to scan and enumerate safely |
Tip
No programming background needed Stages 1–2 assume zero prior Python. If you already write Python, skim to Stage 4 (Data & Resilience) or Stage 5 (The Standard Library), where the security-specific material begins in earnest.
| Component | Recommended | Purpose |
|---|---|---|
| Python runtime | Python 3.11–3.13 (CLI) | The interpreter for every example |
| Package manager | pip 23+ · pipx for standalone tools | Installing and pinning dependencies |
| Virtual environments | venv (standard library) |
One isolated toolchain per project or engagement |
| Editor | VS Code or PyCharm + debugger | Editing and step-debugging |
| Notebook | Jupyter | Interactive analysis and proof-of-concept work |
| Version manager | pyenv | Installing and switching interpreter versions |
| Lab target | A disposable VM or container | Somewhere safe to point the scanning labs |
| Optional | Docker / Docker Compose | Reproducible, disposable lab environments |
Warning
Never install into the system interpreter
sudo pip install writes into the OS Python, can break distribution tooling (Kali ships many Python-based tools), and mixes engagement dependencies into the system. Use a per-project virtual environment, always.
This course targets Python 3.9 as the minimum and 3.11+ as recommended. Python 2 is end-of-life and is not covered.
| Version | Status | Notes |
|---|---|---|
| 3.12 / 3.13 | Recommended | Latest performance and typing improvements |
| 3.11 | Recommended | Exception groups, faster interpreter |
| 3.10 | Supported | Adds the match statement used in one note |
| 3.9 | Minimum | Path.is_relative_to() and zoneinfo land here |
| 3.8 and older | Not supported | Several examples will not run |
| 2.x | Unsupported | End-of-life since 2020 |
Use pyenv to install and switch between interpreters. Details: Python Versions.
The "lab" for this course is a Linux machine with Python 3 and a per-project virtual environment. Stage 7 adds a disposable target VM to scan.
# Check for an existing Python install
python3 --version
python3 -m pip --version
# Debian / Ubuntu / Kali
sudo apt update
sudo apt install -y python3 python3-pip python3-venv
# Fedora / RHEL
sudo dnf install -y python3 python3-pip
# macOS (Homebrew)
brew install python# Recommended per-project workflow
python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install --upgrade pip
python3 -m pip install -r requirements.txt
# Pin what you actually used, so a retest reproduces exactly
python3 -m pip freeze > requirements.txt| Tool | Purpose | Setup note |
|---|---|---|
| VS Code | Primary editor | VS Code Setup |
| PyCharm | Full IDE with debugger | PyCharm Setup |
| Jupyter | Interactive exploration | Jupyter Notebook Setup |
| venv | Per-project isolation | Managing Virtual Environments |
| pip / pipx | Packages and CLI tools | pip Package Manager |
| pyenv | Multiple interpreters | Pyenv |
Tip
Keep it disposable One virtual environment per project or engagement, and a snapshot-capable VM for anything you scan. Reset both freely — nothing in this course should touch a machine you rely on.
The scanning, enumeration, and tooling material needs somewhere safe to point. A minimal setup:
| Role | Suggested | Purpose |
|---|---|---|
| Attacker | Kali Linux VM | Where you write and run the tools |
| Target | A second VM (Metasploitable, DVWA, or a plain Linux box) | Something to scan and enumerate |
| Network | Host-only or internal, no route to production | Contains the traffic you generate |
| Local services | python3 -m http.server, nc -lk |
Instant listeners for the socket labs |
| Public practice target | scanme.nmap.org |
Operated by Nmap expressly for scan practice |
| Synthetic data | Generated log files and hashes | For the log-parser and hash labs — no real credentials |
Caution
Isolate the lab network Keep every lab VM on a host-only or internal network with no route to production or the internet unless a lab explicitly requires it. Never point a scanner at a shared office, hotel, or multi-tenant cloud network.
14 teaching modules grouped into seven progressive stages, each linking to the module's own Readme hub — plus the Python Libraries, Practical Labs, Mini Projects, and Flashcards collections (below) for 18 folders total.
| # | Module | Focus |
|---|---|---|
| 1 | Python Environment Setup | Installing Python, IDEs, pyenv, virtual environments, pip, project layout |
| 2 | Python Objects & Data Structure Basics | Numbers, strings, bytes, lists, dicts, tuples, sets, truthiness |
| # | Module | Focus |
|---|---|---|
| 3 | Python Comparison Operators | Relational, logical, identity, and membership operators; chained comparisons |
| 4 | Python Statements & Control Flow | Conditionals, loops, range, comprehensions, loop control, match |
| # | Module | Focus |
|---|---|---|
| 5 | Methods & Functions | Parameters, return values, *args/**kwargs, scope, lambdas, decorators, closures |
| 6 | Object-Oriented Programming | Classes, attributes, the three method flavours, inheritance, super(), encapsulation, dunder methods |
| # | Module | Focus |
|---|---|---|
| 7 | Input/Output File Handling | File modes, context managers, CSV/JSON/YAML, pickle risks, pathlib, temp files |
| 8 | Error & Exception Handling | try/except/else/finally, custom exceptions, chaining, logging, debugging |
| # | Module | Focus |
|---|---|---|
| 9 | Scripts, Modules, Packages & Libraries | os, sys, argparse, sockets, TLS, hashing, concurrency, __init__.py, packaging |
| 10 | Built-in Functions | map, filter, reduce, zip, enumerate, all/any, sorted, type conversion |
| 11 | Advanced Python Modules | collections, itertools, functools, typing, re, asyncio, pdb |
| # | Module | Focus |
|---|---|---|
| 12 | Advanced Python Data Structures | Advanced numbers, strings, sets, dicts, lists; generators, dataclasses, properties |
| # | Module | Focus |
|---|---|---|
| 13 | Python Automation for Security | Filesystem automation, log parsing, recon scripts, OSINT scraping, subprocess, concurrency, scheduling |
| 14 | Security Tool Development | Sockets, port scanners, HTTP/API clients, Scapy, password and hash utilities, tool architecture, packaging |
17 third-party library references, each with installation, basic usage, important APIs, security use cases, and common mistakes. Start at the Python Libraries index.
| Category | Libraries |
|---|---|
| HTTP & Web | requests · BeautifulSoup · Selenium |
| Networking & Packets | Scapy · dnspython |
| Remote Access | Paramiko |
| Exploitation | pwntools |
| Cryptography | cryptography · pyOpenSSL |
| CLI & Output | Click · Typer · Rich · colorama · tqdm |
| Web Frameworks | Flask · FastAPI |
| System | psutil |
Note
Standard library first
Most of this course runs on the standard library alone — socket, ssl, hashlib, secrets, and urllib cover scanning, TLS inspection, hashing, and HTTP with zero dependencies. That matters on an engagement where you cannot install packages on the host you are working from. Reach for a third-party package when it does something genuinely hard to write yourself.
8 guided labs — each self-contained (objective → prerequisites → lab environment → setup → tasks → complete code → validation → challenges → troubleshooting → security notes → cleanup). Start at the Practical Labs index.
| # | Lab | Difficulty | Primary module |
|---|---|---|---|
| 01 | Password Generator & Strength Checker | Beginner | Security Tool Development |
| 02 | Hash Identifier & Cracker | Beginner | Modules & Packages |
| 03 | File Integrity Monitor | Intermediate | Input/Output File Handling |
| 04 | Log Parser & Brute-Force Detector | Intermediate | Advanced Python Modules |
| 05 | HTTP Header Auditor | Intermediate | Security Tool Development |
| 06 | Subdomain Enumeration | Intermediate | Python Automation for Security |
| 07 | Build a Port Scanner | Advanced | Security Tool Development |
| 08 | Socket Chat Client/Server | Advanced | Security Tool Development |
Warning
Authorized use only Only run these labs against systems you own or are explicitly authorized to test.
16 buildable tools — each a self-contained project that combines several modules into working software with a CLI, structured output, error handling, and a test approach. Start at the Mini Projects index.
| # | Project | Domain | Integrates |
|---|---|---|---|
| 01 | Port Scanner | Networking | Sockets, thread pools, argparse |
| 02 | Banner Grabber | Networking | Sockets, TLS, protocol probes |
| 03 | TCP Client | Networking | Sockets, framing, timeouts |
| 04 | TCP Server | Networking | Sockets, threading, locks |
| 05 | UDP Scanner | Networking | Datagrams, ICMP, retries |
| 06 | Web Crawler | Web | requests, BeautifulSoup, robots.txt |
| 07 | Directory Enumerator | Web | requests, thread pools, baselines |
| 08 | API Client | Web | Sessions, auth, retries, pagination |
| 09 | Password Generator | Crypto & Passwords | secrets, entropy, blocklists |
| 10 | Hash Utility / Cracker | Crypto & Passwords | hashlib, process pools, KDFs |
| 11 | WHOIS Lookup | Recon & OSINT | Sockets, referrals, parsing |
| 12 | DNS Enumeration | Recon & OSINT | dnspython, record types, AXFR |
| 13 | Subdomain Enumerator | Recon & OSINT | Resolution, wildcards, passive sources |
| 14 | File Integrity Monitor | Monitoring | hashlib, pathlib, JSON baselines |
| 15 | Log Analyzer | Monitoring | re, Counter, time windows |
| 16 | Network Inventory Tool | Monitoring | psutil, ipaddress, diffing |
4 spaced-repetition decks — 138 Q::A cards for exam-style revision across the course's core domains. Start at the Flashcards index.
| Deck | Focus |
|---|---|
| Python Fundamentals | Modules 1–6: environment, types, operators, control flow, functions, OOP |
| Data and Modules | Modules 7–11: files, exceptions, packages, built-ins, standard library |
| Security Automation | Modules 12–13: data structures, concurrency, subprocess, log analysis, recon |
| Security Tooling | Module 14 and the libraries: sockets, TLS, hashing, credentials, architecture |
On completion, a student can:
| Domain | Outcome |
|---|---|
| Language core | Write clean, PEP 8 Python 3 with type hints, comprehensions, and meaningful names |
| Program structure | Organise code into functions, classes, modules, and installable packages |
| Data handling | Read and write files, CSV, and JSON safely, including untrusted paths |
| Resilience | Handle network, parsing, and API failures without aborting a long-running run |
| Standard library | Use socket, ssl, hashlib, secrets, and ipaddress with no third-party dependencies |
| Concurrency | Apply threads to I/O-bound work and processes to CPU-bound work, and justify the choice |
| Log analysis | Mine large logs with compiled regular expressions and collections |
| Reconnaissance | Build authorized scanning and enumeration tooling with scope enforced in code |
| Tool engineering | Separate engine from interface, emit structured output, and return meaningful exit codes |
| Delivery | Package a tool with pyproject.toml and test it with the network mocked |
This course's content is exam-relevant preparation and role-focused skill building — it provides supporting knowledge and practical foundations, not a guarantee of passing any exam. Each vendor publishes its own objectives, which change over time; use those as the authoritative checklist.
| Target | Alignment | Strongly covered | Partially covered |
|---|---|---|---|
| PCEP — Certified Entry-Level Python Programmer | ⭐⭐⭐⭐ High | Modules 1–8: types, operators, control flow, functions, exceptions | Exam-specific question formats and timing |
| PCAP — Certified Associate Python Programmer | ⭐⭐⭐⭐ High | Modules 5–12: functions, OOP, modules, packages, the standard library | String-formatting and list-processing edge topics |
| OSCP+ — scripting requirements | ⭐⭐⭐ Moderate | Sockets, automation, tool development, the labs and projects | Exploit development depth and buffer-overflow work |
| CEH — tooling and automation domains | ⭐⭐⭐ Moderate | Modules 13–14 and the library reference | The broader CEH domains outside scripting |
| eJPT / PNPT — practical automation | ⭐⭐⭐ Moderate | Recon and enumeration tooling, reporting output | Manual exploitation and pivoting methodology |
Tip
Best-fit exam The language breadth here maps most directly to PCEP and PCAP — Modules 1–12 cover the language core those exams test end to end. The security tooling in Modules 13–14 and the labs is supporting preparation for OSCP+, CEH, and eJPT/PNPT, where scripting fluency is assumed rather than examined directly.
Armour Infosec Security Team — Security Tool Developer & Python Instructor
Our Python instructors are tool developers and automation specialists who build custom security tools for professional engagements. They combine programming expertise with cybersecurity knowledge, teaching Python through real-world security use cases and hands-on tool development.
Certifications: OSCP+ · CEH · Python Institute Certified · PCAP
Went from zero Python to automating my daily recon workflow. The security-focused examples make learning much more engaging than generic courses.
— Varun D., Security Analyst
The socket programming and advanced modules are exactly what I needed for my pentesting work. Building custom tools is now second nature.
— Divya N., Pentester
Python scripting skills are essential for CTFs. This course gave me the tools and confidence to solve challenges that stumped me before.
— Karan B., CTF Player
Do I need prior programming experience?
No. The course starts from Python fundamentals including installation and basic syntax. Basic computer literacy and familiarity with an operating system is sufficient.
Which Python version is used?
Python 3.9 is the minimum and 3.11+ is recommended. All code uses modern Python 3 syntax. Python 2 is end-of-life and is not covered.
Will I build security tools?
Yes. Modules 13–14, the 8 labs, and the 16 mini projects all produce working software — port scanners, log analysers, file-integrity monitors, and enumeration tooling.
Is this enough for OSCP+ scripting?
It builds the scripting fluency the exam assumes, and the socket and automation material maps directly to common exam tasks. Pair it with a dedicated exploit-development track for the buffer-overflow component.
How is this different from a generic Python course?
Every example, exercise, and project is security-focused. You learn the language by parsing scan output, hashing files, and filtering host lists rather than by building web apps or plotting data.
Do I need a lab to follow along?
For Stages 1–6, no — everything runs locally. Stage 7 and the scanning labs need a disposable target: a second VM, a container, or 127.0.0.1 with a local listener. See Lab Environment.
- Python 3 Documentation — https://docs.python.org/3/
- Python Standard Library — https://docs.python.org/3/library/
- PEP 8 — Style Guide for Python Code — https://peps.python.org/pep-0008/
- Python Packaging User Guide — https://packaging.python.org/en/latest/
- Python Developer's Guide (version status) — https://devguide.python.org/versions/
- Real Python Tutorials — https://realpython.com/
- OWASP Cheat Sheet Series — https://cheatsheetseries.owasp.org/
- OWASP Secure Coding Practices — https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/
- Nmap — Port Scanning Techniques — https://nmap.org/book/man-port-scanning-techniques.html
- Black Hat Python, 2nd Edition (Justin Seitz & Tim Arnold) — https://nostarch.com/black-hat-python2
Sibling courses in this vault that pair well with Python for Security Professionals:
- Certified Ethical Hacking and Penetration Testing — the offensive methodology this tooling supports.
- Linux Administration & Server Hardening — administer and harden the systems these scripts run on and against.
- Secure PHP Development — secure application development from the defender's side.
- Enterprise Windows Infrastructure Security — the Windows estate your tooling will encounter.
- Advanced Web Application Security Testing — where the HTTP and crawling tooling gets applied.
See also the course hub Python for Security Professionals and the full curriculum catalog.
Contributions that improve accuracy, add labs, or deepen module notes are welcome.
| Guideline | Detail |
|---|---|
| Conventions | Follow vault house style: one H1 per note (= filename), an intro sentence, standard sections, language-tagged code fences |
| Links | This course-root Readme uses relative Markdown links ([text](Folder/Note.md)) so it renders on GitHub. Notes below this level use [[wikilinks]]. Keep link integrity when renaming or moving notes |
| Callouts | Use GitHub alert syntax — > [!NOTE], > [!TIP], > [!IMPORTANT], > [!WARNING], > [!CAUTION] (marker alone on its line; a title goes on the next line as > **Title**) |
| Code | Target Python 3.9+, PEP 8, meaningful names, type hints where they help; guard runnable scripts with if __name__ == "__main__": |
| Security | Every example must target 127.0.0.1, a lab VM, or synthetic data. Anything that generates traffic carries an authorization warning. No real credentials, keys, or tokens — ever |
| Scope | Keep each note single-topic; wire new notes into the relevant module Readme hub |
| No placeholders | Do not link to files that do not yet exist; mark planned work as forthcoming |
Warning
All techniques are documented for authorized testing and education only. Test only against systems you own or have explicit written permission to assess.
Content is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) — you may share and adapt it with attribution. Code samples are teaching aids: review and harden them before any production use. Third-party trademarks (Python Software Foundation, Nmap, Offensive Security, EC-Council, and others) belong to their respective owners and are referenced for identification only. Verify every command in an isolated lab before using it, and run reconnaissance tooling only where you are authorized to do so.