Ethical hacking with Python tools
CC Attribution - NonCommercial - ShareAlike 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this
Ortega, Jose Manuel
Jose Manuel Ortega - Ethical hacking with Python tools Python, as well as offering an ecosystem of tools for testing security and application pentesting.Python offers a tool ecosystem for developing our own tools security for testing applications and the servers security,identifying information about servers and potential vulnerabilities. The ultimate objective is show a pentesting tool integrating some of the modules commented and try a demo showing info about our domain target and find vulnerabilities in it, - Nowdays, Python is the language more used for developing tools within the field of security. Many of the tools can be found today as port scanner, vulnerability analysis, brute force attacks and hacking of passwords are written in python. The goal of the talk would show the tools available within the Python API and third-party modules for developing our own pentesting and security tools and finally show a pentesting tool integrating some of the modules. The main topics of the talk could include: **1.Enter Python language as platform for developing security tools** Introduction about the main libraries we can use for introducing in development of security tools such as socket and requests. **2.Libraries for obtain servers information such as Shodan, pygeocoder,pythonwhois** Shodan is a search engine that lets you find specific computers (routers, servers, etc.) and get information about ports and services that are opened. **3.Analysis and metadata extraction in Python for images and documents** Show tools for scraping web data and obtain metadata information in documents and images **4.Port scanning with tools like python-nmap** With python-nmap module we can check ports open for a target ip or domain. **5.Check vulnerabilities in FTP and SSH servers** With libraries like ftplib and paramiko we can check if the server is vulnerable to ftp and ssh anonymous connections.
 Welcome to Jose Manuel Ortega with ethical hiking with Python Tools. Good morning, thank you for coming. Well, this talk is for commenting the main tools that we have in Python ecosystem for obtaining information for servers that is pulling information in the Internet. Well, this talk is about my speaker in Spain where I have another presentation with scraping mobile security and so on. These are the main points I will talk about. I will make an introduction to Python testing. What are the main tools that we have for commenting the main modules like shockers, request, beautiful shoes and shunt for obtaining information for pulling servers. Later, I will mention how to extract metadata for documents and images. And finally, more advanced tools like poor scanning and how to connect with scanner vulnerabilities. And finally, I will show a little proof of concepts where I have integrated all these modules in a Python testing tool. Well, Python is a little introduction. Python is very useful for making rapid prototypes and proof of concepts. And many of the tools that we have for testing security in database and web applications are made with Python. And the main other of the other apprentice that we have is that they are very good documentation in Internet for all these tools that we will comment. Well, for example, one of the main tools that we have for testing applications, for example, SQL map for testing SQL injection vulnerabilities and social engineering tool kit. These tools are made with Python and we have another tool like Sparta. Sparta is a poor scanning that uses Python NMAP. Python NMAP is another tool that I will comment after for checking the ports that are open in a specific domain, server or application. Basically, with this tool, we can check the service that are open and make a process launch a brute force process over a specific service and so on. Another tool that we have that are interesting for analyzing is the Harvested. It's a tool for obtaining information, for information from what this tool is you can use for obtaining information about the domains, email accounts and domains for a specific URL or server. And another very, very, very new tool is the Web Application Attack and Only Framework. This is another tool made with Python. This is very useful for auditing web security and detecting vulnerabilities, SQL injection, cross-scripting and so on. And another tool that we have, for example, SCAPI for analyzing network packets, and for example, if we want to detecting some attacks, SQL injection, you can use these tools. Another tool, another tool that we have is FIMA for example for detecting remote filing, including vulnerabilities. All these tools I have commented are made in pattern and well, I will show the main modules that we can use for developing our tools for testing the security of the servers and web applications. Well, the first proof of concept that we can see is Shokets. With Shokets module, basically what we want to do is checking our security scan. With ConnectEx method, we can check in a specific port if the port is open, filter or closed in a SQA. This is the most simple program that we can write. Basically what we do is a question to the user, the IP of the server and starting port number and ending port number. And with a for loop simple, we check if the port is open, closed or filter. The difference between, for example, in the closed and filter is the filter, the port is filtered where it's blocked by a firewall, for example. Shokets allows also obtain information, resolving the IP address from the domain and vice versa. With the methods getHouse by address and getHouse by name, we can obtain this information. With the Shokets module, also we can check, we can obtain the partner servers. The partner servers is information related with the name of the version of the server, the word server, for example. In an easy way, we can check, for example, this is an script where we pass as parameter the IP address and the port and retours information about the server. In this case, we see that retours that the domain, EuroPython 2016, has an inject server. Well, another of the modules, very now for all Python developers, is request. Request is a very useful module for testing web service, IP res and so on. And basically what we can do for testing the security of the site, for example, we can check, for example, the headers of the request and the response in an easy way. Accessing to the headers property and iterating over the item sectionary, we can obtain this information. For example, if we check over the EuroPython site, we see that we obtain this information, the inject server, and also we see another headers like cookies, the user agent and so on. Another interesting feature that we can make with Request is, for example, it works behind proxy for making requests, we can use the proxy dictionary where we indicate the HTTP or HTTPS proxy. And in an easy way, we can check the connection behind proxy with Request. And another interesting feature is with Request, we can authenticate the, we have a server that supports basic or digest authentication. We can check this information, we can check the security of this server with the methods, HTTPS and the basic. Well, another tool that we have, for web scrapping, for example, is BeautifulSoup. BeautifulSoup is basically a parser, it's a parser. Basically what this does is that it extracts information from a specific task that we extract, that, for instance, we use Request for obtaining the page and with method final, we recover the information. In this case, we recover the links. And more advanced program where we extract the internal and external links. Internal links basically consists in finding all links that begin with a slash. And for external links, we try to find all links that start with HTTP or HTTPS that not contain the current order. In this example, we can see that we extract the external and internal links. The external links go to an external page, I know this, the same domain that is not in the domain that we are testing. And internal links go to pages in the internal domain. Another interesting feature, for example, is we want to extract image and PDF documents. We can use a specific parser. BeautifulSoup has two or three parsers. We have seen the LXML parser and in this case, we are using the HTML parser where we are using SPAR expressions for extracting the element that we want to extract in this case, image and PDFs. Another interesting tool that we have in BiodecosystemBrain is Scrappy. Scrappy is for developing. We can use for developing our web spiders, web crawlers. It's very useful for obtaining the information for web service and URLs. And this tool is a tool for making asynchronous calls and following the event-driven development paradigm for making these calls in asynchronous mode. Well, for the same thing with Shodan, Shodan basically is a useful tool for obtaining pooling information that are available on the Internet. Shodan, what is that is, obtaining the banners of the servers, operating systems, the versions, the server styles, and so on. And basically what this provides a developer API for, in this case, for Python developers. And in a nice way, you can connect with this service, throw a API Shodan API key that provides when you register in the site, you get an API key and with this API key, you can search, we can make the same search, the same search that we can do in the web, you can do with the Python API. In this case, we can see that we look at an information for a specific host and we obtain the posts that are open, retouch the banners of the server, especially the information of the services that are open in this port, and so on. Also, where we search for a specific host, we obtain information about the host name, the posts that are open, and the service that are available in each port. This information that we see in the web, also we can access with Python in a nice way, but the information for accessing is a little tricky, it retouches in a dictionary, but it's not a K-value, a detected K-value, it retouches the information in a dictionary, but certain positions have a vector and an array, and you have to play with accessing the information. Finally, we can obtain information, the same information that we have seen in the Shodan web for a specific host, we can obtain this information from Python API. Another easy module that we have in Python is WillWidth. WillWidth is a very easy module that only has one method, parts, and obtain the information about the frameworks that the website is using, and the web servers that are using the website. Well, for metadata, analysis metadata, basically what we can do with Python in an easy way is extract information from metadata from PDFs with the PyPDF2 module, and basically it's very easy with the pay, what we can do is create a PDF file, a rated object, and with the get.get.com info, we obtain the metadata of the PDF. The same we can do with image with a pill.exe tax module, and in a nice way we can obtain, we can decode the tax that are available in an image. For example, we can obtain the GPS info, the data of the image, when, how is the resolution of the image, and so on. Well, another little advanced feature that we can do is poor scanning. It's very no for the NMAP tool that we can see in multiplat for operating systems, and so on. With Python NMAP, we can launch the NMAP from Python. Basically what we have is two modes, synchronous and asynchronous. For synchronous mode, we have to launch the poor scanner, well, we instantiate the NMAP, the object NMAP with poor scanner, and we use the scan method where we pass as parameter the IP address and the port, the port listing that we want to scan in this IP. This is an example where we define a class NMAP scanner. We initialize the NMAP scanner with calling the poor scanner of the NMAP, and with inside the NMAP scan, we go checking the port, and we are calling the scan method. An internally scanned method called the NMAP command that is installed in the operating system. We can see information about, this is a call sample where we pass as parameter the target and the port listing, and we can see that the NMAP is executed with the default parameters in the port specified and in the IP. We see on retours if it's open and also we can access to the, if a specific port is open, we can access the version of the service and so on. The other mode that we have within NMAP is asynchronous mode. As in cruise mode allows launch and scan in a lot of ports simultaneously. We can define a callback function for where a specific scan in a port is finished, call this function for an additional straddlement in a specific port. For example, in this case we launch in a specific target in the 21 port, the VTP port, and we check, firstly we have to check if it's open, and if it's open we can launch a specific process for detecting vulnerabilities in this port. For example, in this case we are testing the VTP port launching and scripts for checking anonymous FTP login, checking another type or vulnerability, if the service is vulnerable to a specific backdoor, for example, or specific versions to this service. For checking these vulnerabilities, when we start NMAP, NMAP comes by default with NMAP scripts that are in the mass script folder in the instance when you start this tool, and have a lot of scripts for checking vulnerabilities in a specific service, like FTP, HTTP, and MySQL for example. Basically what provides these scripts are routines for a fine potential vulnerability in a given target. And then the idea feels we have to check if the port is open, and if the port is open we can launch the specific script for this service. In this case we are checking that if the MySQL port is open, and if it's open we are launching scripts like MySQL audit, MySQL improved, MySQL databases, these scripts provide more information about the service, and checking for example if the database is open, doesn't have security for example, or you can see the user without authentication, these kind of things you can see with launching the scripts. Well for example with Shonan we can check the FTP login anonymous. Basically with this search we can check all servers or machines that are loaded this type of login with all anonymous is the login anonymous, we don't need to provide user and password for accessing the FTP server. For checking this in Python we have the FTP module that we can see in a nice way, we can check if a specific server allows anonymous login. Well for checking websites we have another tool called P with booth, P with booth provides resources for checking websites basically with predictable URLs, that is to say we have a list of URLs, and each URL, each resource, we will see with an example. For example we can access, in this example we obtain predictable URLs for a specific future, for example for logging in a website we get predictable URLs like admin, login, default web page, admin, and so on, and what we can do is testing for each predictable URL, testing this predictable URL over the domain we are testing. And in a nice way we see that we can check, we make a request over the domain for each predictable URL to see if we can access or not. Many times there are URLs that we don't see, they are not public, but after doing this type of testing we see that there are URLs that are filtered or are not protected, for example, and we can access and navigate and discover other vulnerabilities in the site. Well, the Herblade book is another book that we can test with Python. Herblade is a vulnerability in a specific open SSL version in servers, and this book was discovered in 2014 and well, it's a little old, but with this, we check this page, FilippoioHerblade, we see that there are servers, and there are servers that are also vulnerable to this work. Basically, for testing, if a specific server has this book, basically what we have to do, we can use the socket module and set a specific request, a specific package, and if the server responds with a specific payload Herblade, the server will be vulnerable to this book. In this case, we can see an example where we launch a testing over a specific machine and returns that this machine is vulnerable to this book. Well, a more advanced tool that we can use for integrating with Python, for example, with Metasploit, Metasploit is a very useful tool for sending exploiting vulnerabilities in the servers, in the websites and so on, and Metasploit can be integrated. It has a module called Python MCF-RPC for making calls to Metasploit server from Python. Basically, what we can do is, we have to do is start the server, the service of Metasploit throughout a plugin, and what internally Metasploit functions like modules for testing, for exploiting vulnerabilities, in this case with Metasploit API call, we can see that with calls in a form specific called MCGPEG pack, we can launch a specific module. In this case, we are using the MCGPEG login for launching, for testing this exploiting from Python. Next post, Nexus and OpenBus are security analyzers for vulnerabilities and so on, and also we can integrate these tools from Python. For example, it's really easy to integrate from Python, for example, if we have a server with next post where we have vulnerabilities and reports and so on, we can connect with this server from Python using V2FullSoup, we can access to this information. The information that retours the server is in XML format, and in a nice way with V2FullSoup, we can iterate over the vulnerabilities and sites that are deployed in the next post server. Well, I will show now a pen testing tool that, this is a quick provost concept that has integrated all modules that I have mentioned. Basically, what we can do with pen testing tool is, for example, with a specific machine, a specific port, we can check in if the port is open or not. In this case, we are checking the 21CTP port to see the information that retours. In this case, we can see that the port is open and we can obtain information about the specific version of the CTP. The name and so on. Like the CTP port is open, we can check if the CTP server allows anonymous logging. And then if we go to the 13th option, we see that retours that the port 21 is open and question about if you like to connect with an anonymous user. We question yes and we see that, low-insuccessful, retours 230, the version of the CTP, the connection is OK and shows the directory of the server. More things that we can do if we obtain the headers of the server, the headers info. In this case, we obtain that we have PHP 1.0.5.10 if it's ruining an app and a patch with the version 2.2.8, the version of the PHP and so on. All this is the headers info. More things that we can do, for example, check if the CTP server has a buffer overflow vulnerability. This is another vulnerability that has a lot of servers. We can check with this option. First, we check if the port is open, the port is open, and we send a client request to see the server is vulnerability. We connect to this IP in the port 4444 and we check that the server is vulnerable to this book. Basically, all these testing are over a virtual machine that I have here in local. This is a virtual machine that has a distribution with a lot of vulnerabilities. Many ports open and a lot of vulnerabilities are related with PHP, PHP, Apache, server and so on. This is called a metasplotable Linux, if I remember. More things that we can do is check domains and obtain metadata. For example, if the server has information related with mails, hosts, other servers or URLs that are exposed in the server, we can check this information. In this case, we see that we are testing the options method that retours the server. We can obtain the emails that are public in the server. Also, we can check, for example, if the server is public, we can check the showdown information, that retours. For example, we are using the europaidon site for checking all the information retoured by showdown service. We launch the tool with the target europaidon 216 to 216. It retours the IP address of the domain. For checking, for example, the host info from showdown service, we can use option 6 to disconnect to the showdown service and obtain all the information. It's time for questions. Retours, all public information that we have seen in the presentation, we see that the posts open at 18, 22 and 25 and retours more information about for each service. We obtain information about the servers, the banners, the versions of the server. We obtain the option 10 for scraping image. Finally, this project is available in MagiHabit repository. It's available for if you want to check the tool, you can do free. In MagiHabit repository, we have a small script for testing each functionality separately from each order. For example, if we want to scan and to launch an enema scan, we have a specific script for this feature. Finally, reference and leaves are the main, the official pages of the tools that have commented the showdown documentation, request, Python enemap, documentation, and in the Python security.org, there are available more libraries that have commented and it's a very complete site for checking these kind of tools. Finally, books that we can find, this is the main books that we can find for this topic, for testing and so on. Thank you. Any questions? Thank you.
 Welcome to Jose Manuel Ortega with ethical hiking with Python Tools.  Good morning, thank you for coming.  Well, this talk is for commenting the main tools that we have in Python ecosystem  for obtaining information for servers that is pulling information in the Internet.  Well, this talk is about my speaker in Spain where I have another presentation  with scraping mobile security and so on.  These are the main points I will talk about.  I will make an introduction to Python testing.  What are the main tools that we have for commenting the main modules  like shockers, request, beautiful shoes and shunt for obtaining information for pulling servers.  Later, I will mention how to extract metadata for documents and images.  And finally, more advanced tools like poor scanning and how to connect with scanner vulnerabilities.  And finally, I will show a little proof of concepts where I have integrated all these modules in a Python testing tool.  Well, Python is a little introduction.  Python is very useful for making rapid prototypes and proof of concepts.  And many of the tools that we have for testing security in database and web applications are made with Python.  And the main other of the other apprentice that we have is that they are very good documentation in Internet for all these tools that we will comment.  Well, for example, one of the main tools that we have for testing applications, for example, SQL map for testing SQL injection vulnerabilities and social engineering tool kit.  These tools are made with Python and we have another tool like Sparta. Sparta is a poor scanning that uses Python NMAP.  Python NMAP is another tool that I will comment after for checking the ports that are open in a specific domain, server or application.  Basically, with this tool, we can check the service that are open and make a process launch a brute force process over a specific service and so on.  Another tool that we have that are interesting for analyzing is the Harvested. It's a tool for obtaining information, for information from what this tool is you can use for obtaining information about the domains,  email accounts and domains for a specific URL or server.  And another very, very, very new tool is the Web Application Attack and Only Framework. This is another tool made with Python.  This is very useful for auditing web security and detecting vulnerabilities, SQL injection, cross-scripting and so on.  And another tool that we have, for example, SCAPI for analyzing network packets, and for example, if we want to detecting some attacks, SQL injection, you can use these tools.  Another tool, another tool that we have is FIMA for example for detecting remote filing, including vulnerabilities. All these tools I have commented are made in pattern and well,  I will show the main modules that we can use for developing our tools for testing the security of the servers and web applications.  Well, the first proof of concept that we can see is Shokets. With Shokets module, basically what we want to do is checking our security scan.  With ConnectEx method, we can check in a specific port if the port is open, filter or closed in a SQA.  This is the most simple program that we can write. Basically what we do is a question to the user, the IP of the server and starting port number and ending port number.  And with a for loop simple, we check if the port is open, closed or filter. The difference between, for example, in the closed and filter is the filter, the port is filtered where it's blocked by a firewall, for example.  Shokets allows also obtain information, resolving the IP address from the domain and vice versa. With the methods getHouse by address and getHouse by name, we can obtain this information.  With the Shokets module, also we can check, we can obtain the partner servers. The partner servers is information related with the name of the version of the server, the word server, for example.  In an easy way, we can check, for example, this is an script where we pass as parameter the IP address and the port and retours information about the server.  In this case, we see that retours that the domain, EuroPython 2016, has an inject server.  Well, another of the modules, very now for all Python developers, is request. Request is a very useful module for testing web service, IP res and so on.  And basically what we can do for testing the security of the site, for example, we can check, for example, the headers of the request and the response in an easy way.  Accessing to the headers property and iterating over the item sectionary, we can obtain this information.  For example, if we check over the EuroPython site, we see that we obtain this information, the inject server, and also we see another headers like cookies, the user agent and so on.  Another interesting feature that we can make with Request is, for example, it works behind proxy for making requests, we can use the proxy dictionary where we indicate the HTTP or HTTPS proxy.  And in an easy way, we can check the connection behind proxy with Request.  And another interesting feature is with Request, we can authenticate the, we have a server that supports basic or digest authentication.  We can check this information, we can check the security of this server with the methods, HTTPS and the basic.  Well, another tool that we have, for web scrapping, for example, is BeautifulSoup.  BeautifulSoup is basically a parser, it's a parser.  Basically what this does is that it extracts information from a specific task that we extract, that, for instance, we use Request for obtaining the page and with method final, we recover the information.  In this case, we recover the links.  And more advanced program where we extract the internal and external links.  Internal links basically consists in finding all links that begin with a slash.  And for external links, we try to find all links that start with HTTP or HTTPS that not contain the current order.  In this example, we can see that we extract the external and internal links.  The external links go to an external page, I know this, the same domain that is not in the domain that we are testing.  And internal links go to pages in the internal domain.  Another interesting feature, for example, is we want to extract image and PDF documents.  We can use a specific parser.  BeautifulSoup has two or three parsers.  We have seen the LXML parser and in this case, we are using the HTML parser where we are using SPAR expressions  for extracting the element that we want to extract in this case, image and PDFs.  Another interesting tool that we have in BiodecosystemBrain is Scrappy.  Scrappy is for developing.  We can use for developing our web spiders, web crawlers.  It's very useful for obtaining the information for web service and URLs.  And this tool is a tool for making asynchronous calls and following the event-driven development paradigm  for making these calls in asynchronous mode.  Well, for the same thing with Shodan, Shodan basically is a useful tool for obtaining pooling information  that are available on the Internet.  Shodan, what is that is, obtaining the banners of the servers, operating systems, the versions, the server styles, and so on.  And basically what this provides a developer API for, in this case, for Python developers.  And in a nice way, you can connect with this service, throw a API Shodan API key  that provides when you register in the site, you get an API key and with this API key,  you can search, we can make the same search, the same search that we can do in the web,  you can do with the Python API.  In this case, we can see that we look at an information for a specific host  and we obtain the posts that are open, retouch the banners of the server,  especially the information of the services that are open in this port, and so on.  Also, where we search for a specific host, we obtain information about the host name,  the posts that are open, and the service that are available in each port.  This information that we see in the web, also we can access with Python in a nice way,  but the information for accessing is a little tricky, it retouches in a dictionary,  but it's not a K-value, a detected K-value, it retouches the information in a dictionary,  but certain positions have a vector and an array, and you have to play with accessing the information.  Finally, we can obtain information, the same information that we have seen in the Shodan web  for a specific host, we can obtain this information from Python API.  Another easy module that we have in Python is WillWidth.  WillWidth is a very easy module that only has one method, parts,  and obtain the information about the frameworks that the website is using,  and the web servers that are using the website.  Well, for metadata, analysis metadata, basically what we can do with Python in an easy way  is extract information from metadata from PDFs with the PyPDF2 module,  and basically it's very easy with the pay, what we can do is create a PDF file,  a rated object, and with the get.get.com info, we obtain the metadata of the PDF.  The same we can do with image with a pill.exe tax module,  and in a nice way we can obtain, we can decode the tax that are available in an image.  For example, we can obtain the GPS info, the data of the image,  when, how is the resolution of the image, and so on.  Well, another little advanced feature that we can do is poor scanning.  It's very no for the NMAP tool that we can see in multiplat for operating systems, and so on.  With Python NMAP, we can launch the NMAP from Python.  Basically what we have is two modes, synchronous and asynchronous.  For synchronous mode, we have to launch the poor scanner,  well, we instantiate the NMAP, the object NMAP with poor scanner,  and we use the scan method where we pass as parameter the IP address and the port,  the port listing that we want to scan in this IP.  This is an example where we define a class NMAP scanner.  We initialize the NMAP scanner with calling the poor scanner of the NMAP,  and with inside the NMAP scan, we go checking the port,  and we are calling the scan method.  An internally scanned method called the NMAP command that is installed in the operating system.  We can see information about, this is a call sample where we pass as parameter the target and the port listing,  and we can see that the NMAP is executed with the default parameters in the port specified and in the IP.  We see on retours if it's open and also we can access to the,  if a specific port is open, we can access the version of the service and so on.  The other mode that we have within NMAP is asynchronous mode.  As in cruise mode allows launch and scan in a lot of ports simultaneously.  We can define a callback function for where a specific scan in a port is finished,  call this function for an additional straddlement in a specific port.  For example, in this case we launch in a specific target in the 21 port, the VTP port,  and we check, firstly we have to check if it's open,  and if it's open we can launch a specific process for detecting vulnerabilities in this port.  For example, in this case we are testing the VTP port launching and scripts  for checking anonymous FTP login, checking another type or vulnerability,  if the service is vulnerable to a specific backdoor, for example,  or specific versions to this service.  For checking these vulnerabilities, when we start NMAP, NMAP comes by default with NMAP scripts  that are in the mass script folder in the instance when you start this tool,  and have a lot of scripts for checking vulnerabilities in a specific service,  like FTP, HTTP, and MySQL for example.  Basically what provides these scripts are routines for a fine potential vulnerability in a given target.  And then the idea feels we have to check if the port is open,  and if the port is open we can launch the specific script for this service.  In this case we are checking that if the MySQL port is open,  and if it's open we are launching scripts like MySQL audit, MySQL improved,  MySQL databases, these scripts provide more information about the service,  and checking for example if the database is open, doesn't have security for example,  or you can see the user without authentication,  these kind of things you can see with launching the scripts.  Well for example with Shonan we can check the FTP login anonymous.  Basically with this search we can check all servers or machines that are loaded  this type of login with all anonymous is the login anonymous,  we don't need to provide user and password for accessing the FTP server.  For checking this in Python we have the FTP module that we can see in a nice way,  we can check if a specific server allows anonymous login.  Well for checking websites we have another tool called P with booth,  P with booth provides resources for checking websites basically  with predictable URLs, that is to say we have a list of URLs,  and each URL, each resource, we will see with an example.  For example we can access, in this example we obtain predictable URLs for a specific future,  for example for logging in a website we get predictable URLs like admin,  login, default web page, admin, and so on, and what we can do is testing  for each predictable URL, testing this predictable URL over the domain we are testing.  And in a nice way we see that we can check, we make a request over the domain  for each predictable URL to see if we can access or not.  Many times there are URLs that we don't see, they are not public,  but after doing this type of testing we see that there are URLs that are filtered  or are not protected, for example, and we can access and navigate  and discover other vulnerabilities in the site.  Well, the Herblade book is another book that we can test with Python.  Herblade is a vulnerability in a specific open SSL version in servers,  and this book was discovered in 2014 and well, it's a little old, but with this,  we check this page, FilippoioHerblade, we see that there are servers,  and there are servers that are also vulnerable to this work.  Basically, for testing, if a specific server has this book,  basically what we have to do, we can use the socket module and set a specific request,  a specific package, and if the server responds with a specific payload Herblade,  the server will be vulnerable to this book.  In this case, we can see an example where we launch a testing over a specific machine  and returns that this machine is vulnerable to this book.  Well, a more advanced tool that we can use for integrating with Python,  for example, with Metasploit, Metasploit is a very useful tool for sending exploiting vulnerabilities  in the servers, in the websites and so on, and Metasploit can be integrated.  It has a module called Python MCF-RPC for making calls to Metasploit server from Python.  Basically, what we can do is, we have to do is start the server, the service of Metasploit  throughout a plugin, and what internally Metasploit functions like modules for testing,  for exploiting vulnerabilities, in this case with Metasploit API call,  we can see that with calls in a form specific called MCGPEG pack,  we can launch a specific module.  In this case, we are using the MCGPEG login for launching, for testing this exploiting from Python.  Next post, Nexus and OpenBus are security analyzers for vulnerabilities and so on,  and also we can integrate these tools from Python.  For example, it's really easy to integrate from Python, for example,  if we have a server with next post where we have vulnerabilities and reports and so on,  we can connect with this server from Python using V2FullSoup,  we can access to this information.  The information that retours the server is in XML format, and in a nice way with V2FullSoup,  we can iterate over the vulnerabilities and sites that are deployed in the next post server.  Well, I will show now a pen testing tool that, this is a quick provost concept  that has integrated all modules that I have mentioned.  Basically, what we can do with pen testing tool is, for example, with a specific machine,  a specific port, we can check in if the port is open or not.  In this case, we are checking the 21CTP port to see the information that retours.  In this case, we can see that the port is open and we can obtain information about the specific version of the CTP.  The name and so on.  Like the CTP port is open, we can check if the CTP server allows anonymous logging.  And then if we go to the 13th option, we see that retours that the port 21 is open  and question about if you like to connect with an anonymous user.  We question yes and we see that, low-insuccessful, retours 230, the version of the CTP,  the connection is OK and shows the directory of the server.  More things that we can do if we obtain the headers of the server, the headers info.  In this case, we obtain that we have PHP 1.0.5.10 if it's ruining an app and a patch  with the version 2.2.8, the version of the PHP and so on.  All this is the headers info.  More things that we can do, for example, check if the CTP server has a buffer overflow vulnerability.  This is another vulnerability that has a lot of servers.  We can check with this option.  First, we check if the port is open, the port is open, and we send a client request to see the server is vulnerability.  We connect to this IP in the port 4444 and we check that the server is vulnerable  to this book.  Basically, all these testing are over a virtual machine that I have here in local.  This is a virtual machine that has a distribution with a lot of vulnerabilities.  Many ports open and a lot of vulnerabilities are related with PHP, PHP, Apache, server and so on.  This is called a metasplotable Linux, if I remember.  More things that we can do is check domains and obtain metadata.  For example, if the server has information related with mails, hosts, other servers or URLs that are exposed in the server,  we can check this information.  In this case, we see that we are testing the options method that retours the server.  We can obtain the emails that are public in the server.  Also, we can check, for example, if the server is public, we can check the showdown information, that retours.  For example, we are using the europaidon site for checking all the information retoured by showdown service.  We launch the tool with the target europaidon 216 to 216.  It retours the IP address of the domain.  For checking, for example, the host info from showdown service, we can use option 6 to disconnect to the showdown service  and obtain all the information.  It's time for questions.  Retours, all public information that we have seen in the presentation, we see that the posts open at 18, 22 and 25  and retours more information about for each service.  We obtain information about the servers, the banners, the versions of the server.  We obtain the option 10 for scraping image.  Finally, this project is available in MagiHabit repository.  It's available for if you want to check the tool, you can do free.  In MagiHabit repository, we have a small script for testing each functionality separately from each order.  For example, if we want to scan and to launch an enema scan, we have a specific script for this feature.  Finally, reference and leaves are the main, the official pages of the tools that have commented the showdown documentation,  request, Python enemap, documentation, and in the Python security.org,  there are available more libraries that have commented and it's a very complete site for checking these kind of tools.  Finally, books that we can find, this is the main books that we can find for this topic, for testing and so on.  Thank you.  Any questions?  Thank you.
Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_0_251.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_252_5303.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_5304_9767.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_9768_10403.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_10404_17735.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_17736_20591.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_20592_21947.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_21948_22019.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_22020_22247.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_22248_34391.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_34392_44087.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_44088_44579.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_44580_45863.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_45864_46511.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_46512_47279.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_47280_47879.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_47880_49235.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_49236_50651.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_50652_53087.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_53088_53291.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_53292_53387.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_53388_53519.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_53520_53603.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_53604_53759.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_53760_53807.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_53808_54047.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_54048_55679.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_55680_57047.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_57048_59711.png Jose_Manuel_Ortega_-_Ethical_hacking_with_Python_tools_59712_60251.png