Skip to content

Readme.md

Latest commit

 

History

History
109 lines (79 loc) · 5.91 KB

Readme.md

File metadata and controls

109 lines (79 loc) · 5.91 KB
Raw

Python Objects & Data Structure Basics

Core Python data types and structures — the raw material for parsing tool output, building payloads, and handling network data.

Part of the [[Readme|Python for Security Professionals]] course.

Overview

Every offensive script is built from a handful of built-in types: numbers for offsets and ports, strings and bytes for payloads and wire data, and the collection types (list, dict, tuple, set) for organizing scan results. This module walks each type in learning order, with security-flavored examples throughout — hex-encoding bytes, counting failed logins with a dict, and deduping IPs with a set.

Learning Objectives

  • Do byte, offset, and port math with integers and hex/bin/oct literals.
  • Slice, search, and format strings, and cross the str ↔ bytes boundary cleanly.
  • Choose the right collection — list, tuple, dict, or set — for a given task.
  • Count and deduplicate data (dicts and sets) when parsing tool output.
  • Apply Python's truthiness rules to write correct conditionals on empty or failed results.

Prerequisites

  • [[Python-Environment-Setup/Readme|Python Environment Setup]] — a working Python 3 interpreter and a virtual environment.
  • Comfort with running a script and using the interactive REPL.
  • No prior programming experience is assumed for this module.

Topics Covered

In learning order:

  • [[Numbers]] — integers, floats, arithmetic, and hex/bin/oct for byte and offset math
  • [[Strings-and-String-Manipulation]] — slicing, methods, f-strings, encode/decode
  • [[Print-Formatting|Print Formatting]] — printing and formatting output
  • [[Type-Conversion]] — casting between int, str, bytes, and hex
  • [[Lists-and-List-Operations]] — ordered, mutable collections and comprehensions
  • [[Tuples-and-Immutability]] — immutable records and composite keys
  • [[Dictionaries]] — key-value maps for structured/parsed data
  • [[Sets-and-Set-Operations]] — dedup and set algebra for comparing host/port lists
  • [[Booleans-and-Truth-Values]] — truthiness and the logic behind conditionals

Practical Exercises

  • Parse a saved nmap grep line into a sorted, de-duplicated list of open ports (lists + sets).
  • Build a frequency table of source IPs from a log to spot a brute-force source (dict / Counter).
  • Round-trip an IPv4 address through its packed hex form and back (type conversion).
  • Diff two subdomain-enumeration runs to list only the newly discovered names (set difference).

Security Applications

  • Parsing tool output — splitting an nmap line into fields, then storing open ports in a list and services in a dictionary.
  • Deduplicating discovery results — a set collapses repeated hosts from two enumeration runs, and set difference shows what is new since the last scan.
  • Frequency analysis — a dictionary keyed by source IP counts failed logins, which is the core of brute-force detection.
  • Payload and wire data — bytes (not str) is what crosses a socket; hex literals and .hex() are how you read and build raw values.
  • Configuration and indicators — nested dictionaries hold structured config, IOC lists, and JSON-decoded API responses.
  • Immutable records — tuples make safe composite dictionary keys, such as (host, port).

Common Mistakes

  • Confusing str and bytes — sockets and hashes take bytes; mixing them raises TypeError. Encode explicitly with .encode("utf-8").
  • Mutable default arguments — def scan(hosts=[]) shares one list across every call.
  • Assuming sets preserve order — they do not; sort when you need deterministic output.
  • Using a list for membership tests on large data — in is O(n) on a list and O(1) on a set.
  • Integer division confusion — / always returns a float; use // for integer division.
  • Mutating a list while iterating over it, which silently skips elements.

Best Practices

  • Choose the container by access pattern: list for ordered data, set for membership and dedup, dict for lookup by key, tuple for fixed records.
  • Keep the str/bytes boundary explicit and convert at the edges of your program.
  • Prefer f-strings for formatting and .join() for concatenating many strings.
  • Use dict.get(key, default) rather than catching KeyError for optional data.
  • Sort before printing any set-derived output so results are reproducible.
  • Use collections.Counter instead of hand-rolling a frequency dictionary.

Review Questions

  1. What is the difference between a list and a tuple, and when would you choose each?
  2. When should you use a set rather than a list, and what do you give up?
  3. What security issue can occur if str and bytes are confused when sending data over a socket?
  4. How would you troubleshoot a KeyError raised while parsing a JSON API response?
  5. Why does 0.1 + 0.2 == 0.3 evaluate to False, and when does that matter?
  6. Write a Python example that deduplicates a list of IP addresses and prints them in sorted order.

Commands

# Launch an interactive session to try each type
python3

# Quick one-liners from the shell
python3 -c 'print(hex(8080), int("1f90", 16))'          # base math
python3 -c 'print(set(["10.0.0.1","10.0.0.1","10.0.0.2"]))'  # dedup IPs
python3 -c 'print(b"\xde\xad\xbe\xef".hex())'           # hex-encode bytes

References

Related Notes

  • [[Print-Formatting|Print Formatting]] — the print/format companion note in this module
  • [[Readme|Python for Security Professionals]] — course home

Navigation

  • Previous: [[Python-Environment-Setup/Readme|1. Python Environment Setup]]
  • Home: [[Readme|Course Home]]
  • Next: [[Python-Comparison-Operators/Readme|3. Python Comparison Operators]]