OpenCourser brand icon
Sign in
We may earn an affiliate commission when you visit our partners.

Python

Digital Forensics & Binary Exploits with Python

Packt Publishing

Python is uniquely positioned as a programming language to perform cyber investigations and perform forensic analysis. Unleash the power of Python by using popular libraries and Python tools to help you create efficient and thorough forensics investigations.

Read more

Python is uniquely positioned as a programming language to perform cyber investigations and perform forensic analysis. Unleash the power of Python by using popular libraries and Python tools to help you create efficient and thorough forensics investigations.

This learning paths follows a practical approach & can be of utmost importance as it guides you to read, sort, and sniff raw packets and also analyze network traffic. You will learn various tools required to perform a complete investigation with the utmost efficiency in both Windows and GNU/Linux environments with Python. It then explains binary exploits that allow you to skip past unwanted code, such as the password or product key tests, and add Trojan code. You will perform the exploit development process: finding a vulnerability, analyzing a crash in a debugger, creating a crafted attack, and achieving remote code execution on Windows and Linux.

By the end of the course, you will be able to make the most of Python processes and tackle varied, challenging, forensics-related problems. So, grab this course and think like an attacker.

Contents and Overview

This training program includes 2 complete courses, carefully chosen to give you the most comprehensive training possible.

The first course, Python Digital Forensics starts with network forensics, an important aspect of any investigation. You will learn to read, sort, and sniff raw packets and also analyze network traffic. These techniques will help you drive your host analysis. You will learn about tools you'll need to perform a complete investigation with the utmost efficiency in both Windows and GNU/Linux environments with Python. Next, you will learn more advanced topics such as viewing data in PE and ELF binaries. It's vital to analyze volatile memory during an investigation as it provides details about what is actually running on a given system. So, you will learn the best tools to obtain and analyze volatile memory images. Finally, you will learn how to use Python in order to think like an attacker. You will complete enumeration, exploitation, and data exfiltration. By the end of the course, you will be able to make the most of Python processes and tackle varied, challenging, forensics-related problems. So, grab this course and think like an attacker.

The second course, Binary Exploits with Python takes you through explaining binary exploits that allow you to skip past unwanted code, such as the password or product key tests, and add Trojan code. You will perform the exploit development process: finding a vulnerability, analyzing a crash in a debugger, creating a crafted attack, and achieving remote code execution on Windows and Linux. You will use the gdb debugger to analyze Linux executables and Python code to exploit them. On Windows, you'll use the Immunity debugger and Python.

About the Authors:

  • Daryl Bennett is a manager of a Cyberspace Threat Emulation team with the United States Air Force, where he leads military and civilian members in the employment and execution of offensive security on order to audit the security of network infrastructures. He is a key operator, focusing on risk analysis and the overall security posture of cyberspace systems. Additionally, he has 5+ years' experience working in the open-source community. He is a development specialist in a wide range of domains, including GNU/Linux applications, Android mobile, and autonomous systems. He is passionate about sustaining, developing, and implementing both current and new technologies while practicing analytical problem-solving and learning as much as possible in the process.

  • Sam Bowne has been teaching computer networking and security classes at City College San Francisco since 2000. He has given talks and hands-on at Credentials: Ph.D., CISSP, DEF CON Black-Badge Co-Winner

Enroll now

What's inside

Learning objectives

  • Learn network forensics to drive your host analysis
  • Investigate with the utmost efficiency in windows and gnu/linux environments
  • Get the best tools to obtain and analyze volatile memory images
  • Use python to complete enumeration, exploitation, and data exfiltration
  • Remove unwanted code such as the password or product key tests, and add trojan code
  • Analyze simple windows executable files and modify them using the immunity debugger
  • Analyze simple linux executable files and modify them using the gdb debugger

Syllabus

Python Digital Forensics

This video provides an overview of the entire course.

In this video, we will learn how to inspect network traffic at the packet level using Dshell.

  • Learn to set up a Python virtual environment

  • Learn to import packet capture

  • Use Dshell decoders to fuller analyze automate network traffic

Read more

In this video, we will continue to deepen the level of knowledge of packet analysis with Scapy.

  • Familiarize ourselves with object-oriented notations

  • Practice using the Scapy interactive interpreter

  • Automate packet capture investigation through the Scapy interpreter

In this video, we will design a Python based Scapy tool to automate our network analysis.

  • Familiarize ourselves with common Python data structures

  • Learn to import 3rd party modules into our own application

  • Unleash the power of Python and Scapy by building our own application

In this video, we will add breadth to our Python capability to extend functionality using Impacket.

  • Further expand our application to import Impacket

  • Decode raw packets using Impacket

  • Get a better understanding of encapsulation and how Impacket handles data

In this video, we will develop the technique to scan files in a directory in or to obtain items and properties.

  • Understand the basis of recursion and how it applies to directories

  • Learn about the OS module and how it applies to Python

  • Develop a Python based directory scanner

In this video, we will learn to populate properties of files such as permissions and timestamps.

  • Understand how to populate file properties

  • Populate and examine file permissions

  • Learn and query the different available timestamps of any given file in Windows

In this video, we will become familiar with the Windows registry and how the key:value data store maintains OS configuration data.

  • Learn how to interact with the registry using regedit

  • Use Python to interact with the registry by querying keys

  • Learn to query and enumerate subkeys and further traverse the registry

In this video, we will learn about the Windows Portable Executable format. We will also learn how an attacker may be able to modify an executable to hide information.

  • Learn Python modules to open and read Portable Executables

  • Learn to use pedit to examine Windows binaries

  • Explore and modify the structure of Windows binaries with pedit

In this video, we will further the understanding of directory traversal in GNU/Linux systems. We will also understand and accomplish traversal recursively.

  • Learn the concepts of threading to implement recursive traversing

  • Begin using pools and queues to communicate between threads

  • Build a Python based directory scanner with the ability to traverse directories

Using the power of recursive traversal, we will begin to search and populate file properties.

  • Enrich your understanding of directory traversal

  • Modify our application to populate file properties

  • Search returned results to understand indicators of compromise

In this video, we will explore other important properties of file that will allow you to decipher a known bad or malicious actor.

  • Learn how a digest algorithm works with a file

  • Develop a Python application to hash a file

  • Alter our application to compare file hashes using dynamic arguments

In this video, we will experiment with correlating log entries to events encountered on the system.

  • Learn about system logs and how to access them

  • Learn to interact with the Systemd Journal with Python

  • Continue development by writing entries into the journal

In this video, we will continue our experimentation with reading and parsing system logs.

  • Further interact with the Systemd journal

  • Use our Python skills to effectively parse information regarding system events

  • Narrow down events by looking filtering data with a python application

In this video, we will use the powerful Python based Volatility, learn to import and analyze volatile memory images of Windows-based systems.

  • Learn the basics of how to use the Volatility framework

  • Learn the importance of Volatility profiles and provided plugins

  • Learn to analyze and capture evidence of actual Windows malware with Volatility

In this video, we will capture images of volatile memory on Linux systems. We will also learn to use the Python-based LiMEaide to ease memory capture, especially in remote environments.

  • Begin to understand how LiMEaide acquires memory and how capture differs on Linux-based systems

  • Use LiMEaide to capture a memory image from a Linux system

  • Learn to deploy LiMEaide with pre-generated profiles

In this video, we will continue to expand our knowledge of Volatility by providing images from Linux-based systems.

  • Learn to import and analyze Linux memory images with custom profiles

  • Learn the plugins for Linux systems and how they differ from Windows plugins

  • Find evidence of a remote session in a collected volatile memory image

In this video, we will begin to think as an attacker and learn how to enumerate devices on a network.

  • Learn the basics of calling system commands in Python

  • Learn how to enumerate network devices

  • Using Python, build an application that will perform a ping sweep enumeration

In this video, we will further our attack by enumerating devices found on our network. This will provide us with services that may be exploitable.

  • Introduce network sockets and network connections in Python

  • Use sockets and build a Python application to enumerate open ports of a device

  • Analyze the services running to obtain an attack vector

Once an attack vector has been found we will proceed with exploitation to take over the system.

  • Learn about a common attack vector through exploitable web services

  • Develop a Python-based reverse shell to gain access into the system

  • Exploit the system and understand your access

In this video, we will learn how to perform post enumeration once access has been obtained.

  • Learn what post-enumeration will provide an attacker

  • Learn how popular post-exploitation scripts find data

  • Challenge yourself to modify your enumeration applications to find system data

In this video, we will learn how to perform data exfiltration.

  • Learn how an attacker may exfiltrate data from a system using Python

  • Build a Python application to exfiltrate data across a network

  • Exfiltrate important data from a compromised system proving malicious actions

Test your knowledge
Binary Exploits with Python

This video will give you an overview about the course.

The aim of this video is to teach you about OllyDbg.

  • Explore PuTTY and OllyDbg

  • Learn about searching and breakpoints

  • Modify the EXE

The aim of this video is to create Malware.

  • Get introduced to Kali Linux

  • Learn about Msfvenom Payloads

  • Learn how to deliver the Malware

Learn about adding Trojans.

  • Redirect code execution with OllyDbg

  • Know what happens with the INT 3 instruction

  • Insert real Shellcode

The aim of this video is to teach you about introductory assembly language.

  • Learn about Jasmin, an assembly language simulator

  • Explore addressing and RAM

  • Get to know more about stack

This video is the 1st Challenge.

  • Explore Challenge 1A: hacking a game

  • Learn how to go to the Winners Board

  • Explore Challenge 1B: hacking three games

This video is the 2nd Challenge.

  • Explore Challenge 2A: hacking 19 games

  • Explore Challenge 2B: hacking 256 games

This video is the 3rd Challenge.

  • Know how to perform the final challenge

The aim of this video is to teach you Ping form.

  • Learn about the router configuration page

  • Create a vulnerable form

  • Take up the challenge

Learn about string overflow.

  • Exploit the vulnerable C code

  • Get to know the working of the vulnerable form

  • Take up the challenge

We’ll continue learning the command injection ImageMagick.

  • Explore ImageMagick

  • Demonstrate its command injection vulnerability

  • Take up the challenge

The aim of this video is to cover SQL Injection.

  • Explore database concepts and SQL

  • Demonstrate SQL injection

Let’s continue with some SQL Injection challenges.

  • Challenge 1: display names for administrators

  • Challenge 2: create a file on my server with your name as filename

  • Continue working on Challenge 3 and 4 for your practice

This video will take you through exploring more about redirecting execution.

  • Create a vulnerable program in C

  • View memory usage with Gdb

  • Perform a Buffer Overflow Exploit

The aim of this video is to learn more about using Shellcode.

  • Create a vulnerable program

  • Demonstrate inserting a shellcode

  • Learn about adjusting exploits

The aim of this video is to learn about Msfvenom to make shellcode.

  • Explore the basic options of Msfvenom

  • Learn to find and avoid bad characters

  • Take a look at an example for better understanding

Get to learn more about format string vulnerability with this video.

  • Explore Format Strings

  • Write to the Global offset table

  • Complete your exploit using Four Write Operations

The aim of this video is to learn about heap overflow.

  • Learn about the heap structure

  • Create a vulnerable program

  • Plan and complete the exploit

The aim of this video is to show you some challenges.

  • Understand Challenge 1a and 1b

  • Understand Challenge 2a, 2b and 2c

  • Understand Challenge 3 and 4

The aim of this video is to learn about exploiting windows vulnerabilities with Stack overflow.

  • Get introduced to the Vulnserver reusing

  • Explore how to use Immunity Debugger

  • Write a software that targets EIP

The aim of this video is to learn about ASLR.

  • Explore Mona and learn how to use it

  • Learn how to use Trampoline Code

  • Create the final exploit

The aim of this video is to learn about DEP.

  • Explore more about DEP

  • Learn about ROP

  • Execute using the command

The aim of this video is to learn about heap spray.

  • Learn about defeating ASLR

  • Explore string variables in JavaScript and how to use unescape

  • Exploit heap spray

The aim of this video is to learn how to exploit SEH.

  • Learn about turn off DEP and SEHOP

  • Discuss exception handling

  • Use a stack pivot to create a final exploit

Get to know about SPIKE in this video.

  • Fuzz a simple Ncat Listener

  • Fuzz Vulnserver

  • Detect crashes with Wireshark

The aim of this video is to take up the challenges attacking other methods of vulnerable server.

  • Challenge 1 – Fuzz KSTET with SPIKE

  • Challenge 2 – Complete the GMON Exploit

  • Know how to work around these challenges

Save this course

Save Python: Digital Forensics & Binary Exploits with Python to your list so you can find it easily later:
Save

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in Python: Digital Forensics & Binary Exploits with Python with these activities:
Review Python Fundamentals
Solidify your understanding of Python fundamentals to better grasp the forensic and exploit techniques used in the course.
Browse courses on Python Basics
Show steps
  • Review basic Python syntax and data types.
  • Practice writing simple Python scripts.
  • Work through online Python tutorials or exercises.
Hacking: The Art of Exploitation
Gain a deeper understanding of exploit development principles and techniques, enhancing your ability to analyze and exploit binaries.
View Hacking: The Art of Exploitation, 2nd Edition on Amazon
Show steps
  • Read selected chapters focusing on buffer overflows and shellcode.
  • Work through the code examples and exercises.
  • Experiment with different exploit techniques.
Review Violent Python
Gain practical experience in using Python for security tasks, complementing the course's theoretical knowledge.
View Melania on Amazon
Show steps
  • Read selected chapters focusing on network and exploit development.
  • Try out the code examples provided in the book.
  • Adapt the examples to solve similar problems.
Four other activities
Expand to see all activities and additional details
Show all seven activities
Build a Simple Packet Sniffer
Apply your Python and networking knowledge to create a tool that captures and analyzes network traffic, reinforcing the network forensics concepts.
Show steps
  • Research Python libraries for packet capture (e.g., Scapy).
  • Write code to capture network packets.
  • Implement basic packet filtering and analysis.
  • Add features to display packet information.
Practice Binary Reversing Challenges
Sharpen your binary analysis skills by solving challenges on platforms like Crackmes.one, which will help with binary exploits.
Show steps
  • Find binary reversing challenges online.
  • Use debuggers (GDB, Immunity Debugger) to analyze binaries.
  • Identify vulnerabilities and develop exploits.
Document Exploit Development Process
Create a blog post or video tutorial explaining a specific binary exploit technique covered in the course, solidifying your understanding.
Show steps
  • Choose a specific exploit technique.
  • Recreate the exploit in a controlled environment.
  • Document each step of the process clearly.
  • Share your content online and gather feedback.
Contribute to a Forensics Tool
Enhance your skills by contributing to an open-source digital forensics tool, applying your knowledge to real-world problems.
Show steps
  • Identify an open-source forensics tool project.
  • Explore the codebase and identify potential areas for contribution.
  • Contribute by fixing bugs, adding features, or improving documentation.

Career center

Learners who complete Python: Digital Forensics & Binary Exploits with Python will develop knowledge and skills that may be useful to these careers:
Exploit Developer
An Exploit Developer creates code that takes advantage of vulnerabilities in software or systems. This course directly teaches the skills that are required. The core focus of the curriculum is creating exploits, analyzing vulnerabilities and achieving remote code execution. The lectures on debuggers and different operating systems can be extremely helpful. This course may be useful for those looking to find work developing exploits.
See salaries and explore the career path for Exploit Developer
Digital Forensics Analyst
As a Digital Forensics Analyst, one uncovers and analyzes electronic data to solve or prevent crimes. This course helps you think like an attacker, a beneficial mindset when performing forensics investigations. The lectures on using Python to complete enumeration and data exfiltration are especially useful. The practical overview of using Python for digital forensics, and in both Windows and GNU/Linux environments provides a robust foundation for this role. The course may be useful for using Python to tackle varied, challenging, forensics-related problems.
See salaries and explore the career path for Digital Forensics Analyst
Malware Analyst
A Malware Analyst identifies, analyzes, and dissects malicious software to understand its behavior and develop countermeasures. The course helps build a foundation for malware analysis through its sections on binary exploits, memory forensics, and network traffic analysis. The lectures on using Python to analyze executable files and automate analysis tasks are highly relevant. The course may be useful for those looking to develop expertise in dissecting malware and understanding exploit techniques. A Malware Analyst might also use code from a binary exploit for reverse engineering purposes.
See salaries and explore the career path for Malware Analyst
Penetration Tester
A Penetration Tester, also known as an ethical hacker, attempts to find and exploit vulnerabilities in systems. The course directly aligns with this role by teaching exploit development, binary analysis, and techniques for achieving remote code execution. The emphasis on using Python for enumeration, exploitation, and data exfiltration is invaluable. The lectures on debuggers such as gdb and Immunity as well as skills in both Windows and Linux environments helps you perform comprehensive penetration tests. A Penetration Tester may find the course useful.
See salaries and explore the career path for Penetration Tester
Vulnerability Researcher
Vulnerability Researchers discover security flaws in software and hardware. The course directly supports this role by focusing on binary exploitation, vulnerability analysis, and exploit development. The lectures on finding vulnerabilities, analyzing crashes, and creating crafted attacks are invaluable. The skills gained in using debuggers and Python automation are essential for efficient vulnerability research. The course may be useful for those seeking to contribute to the security community by identifying and reporting security weaknesses.
See salaries and explore the career path for Vulnerability Researcher
Reverse Engineer
Reverse Engineers analyze software to understand its inner workings, often to find vulnerabilities or bypass security measures. This course provides the skills needed to excel in reverse engineering, particularly the sections on binary exploits and analyzing executable files. The practical skills in using debuggers and Python scripting are directly applicable. The lectures on modifying binaries and understanding assembly language directly contribute to a Reverse Engineer's capabilities. One pursuing a career as a Reverse Engineer may find the course useful.
See salaries and explore the career path for Reverse Engineer
Security Engineer
A Security Engineer is responsible for protecting computer systems and networks from threats. This course may be useful for understanding how attackers exploit vulnerabilities, which is crucial for building robust defenses. The course's coverage of binary exploits, including finding vulnerabilities and achieving remote code execution on Windows and Linux, is highly relevant. The lectures on Python and network traffic analysis, along with using debuggers such as gdb and Immunity, equips a Security Engineer with valuable skills. The course may be useful for learning to think like an attacker.
See salaries and explore the career path for Security Engineer
Network Security Engineer
Network Security Engineers designs, implements, and manages network security infrastructure to protect an organization's data and systems. The course helps build skills in network forensics and traffic analysis. The lectures on using Python to read, sort, and sniff packets is particularly valuable, as are the lectures on network sockets and network connections in Python. A Network Security Engineer may find this course useful.
See salaries and explore the career path for Network Security Engineer
Incident Responder
Incident Responders are responsible for handling security breaches and mitigating their impact. The course helps build a strong foundation for incident response by covering network forensics, memory analysis, and techniques for identifying malicious activity. The lectures on using Python to parse logs, analyze network traffic, and investigate compromised systems are directly applicable. The course may be useful for those looking to develop expertise in containing and eradicating security incidents.
See salaries and explore the career path for Incident Responder
Cybersecurity Analyst
A Cybersecurity Analyst monitors and protects an organization's networks and systems. This course helps you understand the techniques attackers use, enabling you to better defend against them. The sections on network forensics, analyzing memory images, and performing enumeration are particularly useful. The lectures on using Python to analyze network traffic with Scapy and Impacket may be useful for developing custom security tools. The course may be useful for those looking to enhance their skills in incident response and threat hunting as a Cybersecurity Analyst.
See salaries and explore the career path for Cybersecurity Analyst
Security Consultant
A Security Consultant advises organizations on how to improve their security posture. This course helps build credibility as a consultant by demonstrating expertise in vulnerability analysis, exploit development, and incident response. The sections on binary exploits, network forensics, and memory analysis provide a broad understanding of security risks and mitigation strategies. The course may be useful for those looking to provide expert advice to clients on securing their systems and data.
See salaries and explore the career path for Security Consultant
Application Security Engineer
Application Security Engineers focus on securing software applications throughout the development lifecycle. This course helps them understand common vulnerabilities, how to exploit them, and how to prevent them. The coverage of binary exploits, format string vulnerabilities, and heap overflows provides valuable insight into application-level security flaws. The course may be useful for those looking to implement secure coding practices and perform security testing on software applications.
See salaries and explore the career path for Application Security Engineer
Security Auditor
Security Auditors evaluate an organization's security policies and practices to identify weaknesses and ensure compliance. Learning how to think like an attacker is a valuable skill for any security auditor. The course may be useful for assessing the effectiveness of security controls and identifying potential vulnerabilities. Security auditors may wish to explore topics like network security or vulnerability assessment.
See salaries and explore the career path for Security Auditor
Security Architect
A Security Architect designs and oversees the implementation of security systems and infrastructure. This course may provide a deeper understanding of attack vectors and vulnerabilities. The course focuses on concepts like binary exploitation, memory forensics, and network traffic analysis. While a Security Architect typically requires a broad understanding of security, familiarity with the topics in this course may be helpful. A security architect may find this course useful.
See salaries and explore the career path for Security Architect
Cryptography Engineer
A Cryptography Engineer designs and implements cryptographic systems to protect data. While this course does not focus specifically on cryptography, it may provide a solid foundation in security concepts and attack methodologies. Understanding how attackers exploit vulnerabilities is valuable even when designing secure systems. The course may be useful for those looking to build a broader understanding of security. Typically, a professional in this field needs an advanced degree. A Cryptography Engineer may find this course useful.
See salaries and explore the career path for Cryptography Engineer

Reading list

We've selected two books that we think will supplement your learning. Use these to develop background knowledge, enrich your coursework, and gain a deeper understanding of the topics covered in Python: Digital Forensics & Binary Exploits with Python.
Cover image
Hacking: The Art of Exploitation, 2nd Edition
Save
Provides a deep dive into exploit development, covering topics like buffer overflows, shellcode, and network programming. It is highly relevant to the binary exploits portion of the course. While challenging, it offers a comprehensive understanding of the underlying principles. It is often used as a textbook in advanced security courses.
Hacking: The Art of Exploitation, 2nd Edition
Paperback
$$
Hacking: The Art of Exploitation, 2nd Edition
Kindle Edition
$$
Cover image
Think and Grow Rich - English : For Personal Growth...
Save
Provides practical examples of using Python for offensive security tasks. It covers topics like network sniffing, vulnerability scanning, and exploit development, which are directly relevant to the course. While not a prerequisite, it offers valuable hands-on experience. It is commonly used by security professionals and students alike.
Melania
Hardcover
$$
From Here to the Great Unknown: Oprah's Book Club:...
Hardcover
$$
War
Hardcover
$$
The Message
Hardcover
$$
Good Energy: The Surprising Connection Between...
Hardcover
$$
Be Ready When the Luck Happens: A Memoir
Hardcover
$$
The Anxious Generation: How the Great Rewiring of...
Hardcover
$$
Onyx Storm (Deluxe Limited Edition) (The Empyrean,...
Hardcover
$$
Spooky Cutie: Coloring Book for Adults and Teens...
Paperback
$
The Leaf Thief: (The Perfect Fall Book for Children...
Paperback
$$

Share

Help others find this course page by sharing it with your friends and followers:
Facebook
LinkedIn
Reddit
X
Link
Email

Similar courses

Similar courses are unavailable at this time. Please try again later.
Effort
6 total hours
Via
Udemy
Instructor
Packt Publishing
Language
English
Share and help others discover this course.
Facebook LinkedIn X Reddit Link Email
Don't miss out
Enroll today to gain access to this course
Enroll in this course
Our mission

OpenCourser helps millions of learners each year. People visit us to learn workspace skills, ace their exams, and nurture their curiosity.

Our extensive catalog contains over 50,000 courses and twice as many books. Browse by search, by topic, or even by career interests. We'll match you to the right resources quickly.

Find this site helpful? Tell a friend about us.

Affiliate disclosure

We're supported by our community of learners. When you purchase or subscribe to courses and programs or purchase books, we may earn a commission from our partners.

Your purchases help us maintain our catalog and keep our servers humming without ads.

Thank you for supporting OpenCourser.

© 2016 - 2025 OpenCourser