Skip to content

Readme.md

Latest commit

 

History

History
135 lines (99 loc) · 7.22 KB

Readme.md

File metadata and controls

135 lines (99 loc) · 7.22 KB
Raw

Python Environment Setup

Set up an isolated, reproducible Python tooling environment on Linux for security scripting — per-engagement virtual environments, pinned dependencies, and a clean system interpreter.

Part of the [[Readme|Python for Security Professionals]] course.

Overview

Before writing a single scanner or exploit, a security professional needs a dependable Python setup: a supported Python 3 interpreter, a comfortable editor with a debugger, and — most importantly — isolation so each engagement gets its own pinned toolchain that never pollutes the OS interpreter. This module walks from installing Python through IDE choice, virtual environments, package management, and project layout. The security throughline is reproducibility and isolation: a per-engagement venv with a pinned requirements.txt reruns identically on a retest, and keeps loot, secrets, and dependencies from leaking.

Learning Objectives

By the end of this module you will be able to:

  • Install and verify a supported Python 3 interpreter on Linux.
  • Manage multiple interpreter versions with pyenv.
  • Choose and configure an IDE with a debugger and the correct interpreter.
  • Create, activate, and manage per-project virtual environments.
  • Install, pin, and reproduce dependencies with pip and requirements.txt.
  • Lay out a Python project so it can grow into an installable tool.

Prerequisites

  • A Linux system (Kali, Debian, Ubuntu, Fedora, or similar) with sudo access.
  • Basic shell familiarity — navigating directories, editing files, running commands.
  • No prior Python experience is assumed; this is the first module of the course.

Topics Covered

Work through these in order:

  1. [[Python-Overview|Python Overview]] — why Python for security, the language at a glance
  2. [[Installing-Python-on-Linux]] — installing and verifying Python 3 across distros
  3. [[Python-Versions]] — Python 2 vs 3, version selection, checking versions, EOL
  4. [[Pyenv]] — installing and switching between multiple Python versions
  5. [[Selecting-an-IDE]] — choosing between VS Code, PyCharm, Jupyter, and terminal editors
  6. [[VS-Code-Setup]] — VS Code + Python extension, venv selection, debugging
  7. [[PyCharm-Setup-and-Configuration]] — project interpreter, venv, and debugger config
  8. [[Jupyter-Notebook-Setup]] — interactive notebooks for analysis and PoC exploration
  9. [[Managing-Virtual-Environments]] — venv/virtualenv, activate/deactivate, why isolation matters
  10. [[Pip-Package-Manager]] — pip, pipx, requirements.txt, install/upgrade/freeze
  11. [[Project-Structure-Best-Practices]] — src layout, __init__.py, requirements, README, .gitignore

Learning Path

Start with [[Installing-Python-on-Linux]] and [[Python-Versions]] to get a working interpreter, pick and configure an editor, then make [[Managing-Virtual-Environments]] and [[Pip-Package-Manager]] second nature — they underpin every later module. Finish with [[Project-Structure-Best-Practices]] before you begin building real tools.

Practical Exercises

  1. Install Python 3 and confirm the version with python3 --version and sys.version_info.
  2. Install pyenv and switch between two interpreter versions in the same shell.
  3. Configure your editor to use a project's virtual environment rather than the system interpreter.
  4. Create a venv, install requests into it, and confirm the system Python cannot import it.
  5. Freeze the environment to requirements.txt, delete the venv, and rebuild it from the file.
  6. Lay out a project with a src/ directory, pyproject.toml, README.md, and .gitignore.
  7. Add .venv/, *.log, and an engagement output directory to .gitignore and verify with git status.

Security Applications

  • Per-engagement venvs — one isolated environment per client/engagement so toolchains never collide.
  • Pinned dependencies — a frozen requirements.txt makes scans and exploits reproducible on retest and in CI.
  • Clean system interpreter — never sudo pip install; keep the OS Python (and Kali's own tooling) unbroken.
  • No leaked artifacts — .gitignore keeps venvs, secrets, and engagement loot out of version control.

Common Mistakes

  • sudo pip install — writes into the system interpreter, can break distribution tooling (Kali ships many Python-based tools), and mixes engagement dependencies into the OS.
  • Forgetting to activate the venv — packages install globally and the script runs against the wrong interpreter.
  • Running python instead of python3 — on many systems python is absent or points somewhere unexpected.
  • Committing the virtual environment to version control instead of requirements.txt.
  • Unpinned dependencies — a retest months later silently uses different library versions.
  • Committing engagement artifacts — loot, scan output, and .env files leaking into a repository.
  • Editor using the wrong interpreter, so imports resolve in the IDE but fail on the command line.

Best Practices

  • One virtual environment per project or engagement; never share one.
  • Never use sudo pip; use a venv, or pipx for standalone command-line tools.
  • Pin dependencies with pip freeze > requirements.txt and commit that file.
  • Keep .venv/, __pycache__/, .env, and output directories in .gitignore.
  • Target Python 3.9 or newer and record the minimum in pyproject.toml.
  • Point your editor at the project venv explicitly, and verify with which python.
  • Adopt the src/ layout from the start so the project can be packaged later.

Review Questions

  1. What is the difference between a system-wide package install and a virtual environment install?
  2. When should you use pipx rather than pip inside a venv?
  3. What security issue can occur if engagement output or a .env file is committed to a repository?
  4. How would you troubleshoot a script that imports a package successfully in your IDE but fails from the terminal?
  5. Why is sudo pip install particularly risky on Kali Linux?
  6. Write the commands to create a venv, install a package, and freeze the dependency list.

Commands

# Verify the interpreter
python3 --version
which python3
python3 -c "import sys; print(sys.version_info[:3])"

# Create and activate a per-project virtual environment
python3 -m venv .venv
source .venv/bin/activate
which python            # should now point inside .venv

# Install and pin dependencies
python3 -m pip install --upgrade pip
python3 -m pip install requests
python3 -m pip freeze > requirements.txt

# Rebuild the environment elsewhere
python3 -m pip install -r requirements.txt

# Leave the environment
deactivate

References

Related Notes

  • [[Python-Overview|Python Overview]]
  • [[Readme|Python for Security Professionals]] — course home

Navigation

  • Home: [[Readme|Course Home]]
  • Next: [[Python-Objects-and-Data-Structure-Basics/Readme|2. Python Objects & Data Structure Basics]]