[No audio]
The last scripting environment we're going to look
at is Python. Now Python, like Ruby is way bigger
than just a scripting language. It's actually a
full featured high level multipurpose language.
It's also either object oriented and/or
procedural, you can do both or you can do either
or. So it allows or supports different programming
paradigms. You can do a lot of work very rapidly
in Python. It's a great language as an
introductory language as well. It's easy to learn,
easy to use, and there's a tremendous number of
libraries out there. So you don't have to re-invent
the wheel every time you want to do something. You just go out,
find the library you want, include
it, and boom, you've got access to lots of pre written code.
That's why Python is such a good fit
for penetration testing. It's easy to learn, easy
to use, fast to prototype, and you can create some
really powerful scripts with just a little bit of
source code. So let's take a peek under the hood
and look at some Python code. So here is a simple
Python script. This, again, is a port scanner.
So if we start from the very beginning, we're going
to import two libraries, the sys library and the
socket library. The first thing we do is we grab
our input arguments, we grab argv 1, put it in
target, and we grab argv 2 and argv 3 and put
them in min and maxport. Now, I will tell you
that this is not the most elegant way to bring
input arguments into Python, it's actually kind of
a brute force way. There's much more elegant way
that only takes a little bit more code. But we're
trying to make everything really simple and
accessible here, so that the scripts look as much
like the other languages as possible. So be aware,
you shouldn't write your scripts this way. But
this works for now. Once we assigned target,
minimum, and maximum port, then we're going to
create a function. In Python, we create functions
by using the def keyword, so it's define or
def porttry, that's the name of the function.
We're going to try current_target and port. A
couple of things to notice that make Python
different than other languages. First off, you'll
notice that in my blocks, there's no in statement.
I have a defined statement for my function, and at
the bottom, here's my for block. There's no in
statement. Python doesn't use block headers and
block terminator statements. Python uses
indentation, and the indentation dictates what
belongs to what block. It's extremely important
that you get your indents correct, or Python will
get confused. Let's look at the for block.
Everything that's indented, in this case, we used
four characters, the s equals socket, value, and the
whole if block are part of the for block because
they're indented. The print statement is part of
the if block or the if statement because it's been
indented. So indentation dictates actual syntax.
So it's very important, if the Python interpreter
yells at you because your indentation is wrong,
you've got to go in and fix it,
and you have to be a little bit careful when you use a different editor,
because if you indent four spaces one
place, and then use a tab somewhere else, it may
look the same, but Python will actually tell you,
you know, you've got to be consistent. So a little
frustrating at first, but once you get the hang of
it, it's a lot less code because I never have to
worry about ending my statements. It reads the way
that it's going to be executed. Error handling
is using try and except, the way we implement error handling rather.
So what happens is in a block, we try certain statements, if
there's an error, we run the except. So this is
the way our function works. We invoke the
function, we try a particular port on a target, we
attempt to connect. If we connect without error,
we return a True, if there's an error, it drops
into the except block and returns None. Alright,
so let's go into our main block. for i in range of
minport to maxport+1, well, that's pretty easy.
We simply go from whatever the user types in from
minport up to maxport+1. We define a socket,
and then we say value is equal to porttry
target and i, so basically, we try the target, and
we range our ports from minimum to maximum
one at a time, and for each try, we get back
either a None or a True. If the value is not None,
we could have said the value equals True, then we
print Port open. Otherwise, we're done. We go to
the next iteration of the for block, and notice
the output for Python is simply the print
statement. So that's a little bit different than
other languages as well. All right, so enough
digging through code. Let's see the thing
operating. The way we run it, we type in python,
python portscan.py 10.10.1.10 and we'll
go from port 20 to 80,
and there we go. It's done. It shows us which
ports are open and that's pretty much the same
ports that we saw in the other port scanners. So
that wraps up our summary of the different
languages. You've looked at four different
environments, and you've seen a port scanner
written in each environment. There's similarities,
but there's also some differences. Now, let's dig
down a little bit further, and let's look at some
of the specific differences between each of these
environments. It'll help you decide which one is
most comfortable for you. But regardless of which
one you like the best. Make sure that you can
recognize syntax from all the four basic languages
because that's what the PenTest+ exam is going to ask you about.
[No audio]