Interactive Python Cybersecurity Roadmap

From Fundamentals to Advanced Applications with Detailed Instructions

Beginner Projects: Mastering the Basics

A fundamental tool for network reconnaissance. This project teaches socket programming and handling user input.

  • Step 1: Connect to a Single Port

    Instruction: Use Python's built-in socket library. Write a script to create a socket object and attempt a connection to a specific port on a target IP. Handle both successful and failed connections to determine if the port is open or closed.

  • Step 2: Get User Input

    Instruction: Make your tool interactive. Use the input() function to prompt the user for an IP address to scan. You can also prompt for the port numbers later.

  • Step 3: Scan a Range of Ports

    Instruction: Instead of one port, scan a series of common ports. Use a for loop to iterate through a range of numbers (e.g., 1 to 1024) and place your connection logic inside this loop.

  • Step 4: Improve Performance with Threading

    Instruction: Speed up your scanner significantly. Use the threading module to create a worker function that attempts the connection. Start a new thread for each port so many connections can be attempted simultaneously.

  • Step 5: Refine the Output

    Instruction: Make the results clean. Instead of printing a message for every closed port, store the open ports in a list. After the scan is complete, print a summary of only the open ports found.

A cornerstone of host-based security. Creates a "fingerprint" of files and checks for modifications.

  • Step 1: Hash a Single File

    Instruction: Use the hashlib library. Write a function that takes a file path, reads the file's content in binary mode ('rb'), and returns its SHA-256 hash as a hex digest.

  • Step 2: Create a Baseline

    Instruction: Use os.walk to recursively list all files in a directory. For each file, generate its hash and store the results (filepath: hash) in a dictionary. Save this dictionary to a file using the json library.

  • Step 3: Verify Integrity

    Instruction: Load the baseline JSON file. Rescan the directory and for each file, compare its current hash to the baseline hash. Report on `MODIFIED` (hash mismatch), `NEW` (not in baseline), and `DELETED` (in baseline but not on disk) files.

  • Step 4: Add Command-Line Arguments

    Instruction: Use the argparse module to create a professional command-line interface. It should accept arguments to specify the mode (`--generate` or `--check`) and the target directory.

Advanced Projects: Complexity & Design

Design Pattern: Strategy

Define a family of algorithms (protocol parsers), encapsulate each one, and make them interchangeable. This lets you switch between parsing TCP, UDP, or ICMP without changing the main sniffer logic.

  • Step 1: Environment Setup & First Capture

    Instruction: Install the scapy library (`pip install scapy`). Experiment with its `sniff()` function to capture a few packets and print their summary to see live traffic.

  • Step 2: Implement the Strategy Pattern

    Instruction: Define the code structure. Create an abstract base class `ParserStrategy` with an abstract `parse` method. Then, create a `PacketParser` context class that will hold and use a strategy object.

    This step is about code structure and will not have a direct visual output.

  • Step 3: Create Concrete Parsers

    Instruction: Create classes like EthernetParser, IpParser, and TcpParser that inherit from `ParserStrategy`. In each class, implement the `parse` method to unpack the specific protocol header from the raw packet bytes and extract its fields.

  • Step 4: Build the Main Sniffer Logic

    Instruction: Create a raw socket to capture packets. In a loop, receive data and orchestrate the parsing. Start with the `EthernetParser`, then based on its result, switch the strategy in your `PacketParser` context to the correct L3 parser (e.g., `IpParser`), and so on for L4.

⚠️ Ethical Warning

This project is for educational purposes only. Unauthorized monitoring is illegal and unethical. Only run on systems you own and have permission to test.

Design Pattern: Singleton

Ensures that only one instance of your keylogger class can ever exist. This is crucial to prevent multiple instances from conflicting or consuming unnecessary resources.

  • Step 1: Capture Keystrokes

    Instruction: Use the pynput library. Create a keyboard `Listener` and define a callback function (`on_press`) that gets executed every time a key is pressed. For now, just print the key to the console.

  • Step 2: Log to a File

    Instruction: In your `on_press` function, instead of printing, append the keystroke data to a string or list. Write a separate method to save this log buffer to a file (e.g., in a temporary or hidden directory).

  • Step 3: Send Logs via Email

    Instruction: Use Python's built-in smtplib and email modules. Write a function to log into an email account (use a dedicated app password, not your main password) and send the contents of the log file to a recipient email address.

  • Step 4: Combine and Automate

    Instruction: Use threading.Timer to call your email reporting function at regular intervals (e.g., every hour). Instantiate your `Keylogger` (using the Singleton pattern) and start the listener. The script should now run as a cohesive, automated agent.

⚠️ Ethical Warning

Only run this scanner against web applications you own or have explicit, written permission to test. Unauthorized vulnerability scanning is illegal.

Design Pattern: Factory Method

Provides an interface for creating "scanner" objects but lets subclasses (your main engine) decide which class to instantiate. This makes it easy to add new vulnerability modules (XSS, SQLi, LFI) later.

  • Step 1: The Core Engine: Crawling

    Instruction: Use the requests library to fetch a page's HTML and BeautifulSoup to parse it. Write a crawler that takes a starting URL, extracts all `<a>` and `<form>` tags, and adds them to a queue of targets to scan.

  • Step 2: Create Scanner "Products"

    Instruction: Implement the logic for specific vulnerability checks. Create an `XssScanner` class that injects XSS payloads into inputs and checks the response. Create an `SqlInjectionScanner` that injects SQL payloads and checks for database errors or changes in response.

  • Step 3: Implement the Factory & Main Logic

    Instruction: Create a `ScannerFactory` class that can create scanner objects based on user input (e.g., "xss"). The main script will take a target URL, use the factory to create the desired scanners, and run them against the list of crawled targets.

    This is a logic and structure step; the final report is the key output.

  • Step 4: Reporting

    Instruction: Create a reporting module. When a scanner finds a potential vulnerability, it should log the details (URL, parameter, payload). At the end of the run, print a clean, well-formatted summary of all findings.