HackBlue

Tools · Workbench

Python and Bash for security automation

Tutorials on parsing logs, hashing files, calling APIs safely, writing regex that does not explode, and small Bash and Python tools for defenders.

  • 20 lessons
  • 3.5 h of reading
  • 3 topics
Start with lesson 1All workbenches

Most security automation is a short script that reads something, counts something, and prints a list a human can review. These tutorials build those scripts in Python and Bash with the habits that keep them safe: no secrets on the command line, bounded input, and output someone can verify.

Every script runs on sample files or local services you control.

Python for defenders

10 lessons

  1. 01Setting up Python for security scripting: virtual environments, pinned dependencies, and secretsCreate isolated environments, pin and hash dependencies, keep API keys out of code with environment variables, and structure a small script so it is easy to reuse.9 min
  2. 02Build a Python command-line tool that summarizes SSH failures from auth logsWrite a script that reads Linux auth logs, including rotated gzip files, extracts failed logins with a regex, and prints top sources and usernames with optional CSV output.11 min
  3. 03Checking your website’s security headers with Python requestsWrite a script that fetches your own sites and reports missing or weak security headers such as HSTS, Content-Security-Policy, and cookie flags.9 min
  4. 04Writing a file integrity baseline script in Python with SHA-256Hash every file in a directory tree into a JSON baseline, compare later runs to report added, removed, and changed files, and run it on a schedule.10 min
  5. 05Enriching file hashes with the VirusTotal API in Python, safely and within rate limitsLook up hashes, not files, with the VirusTotal v3 API, respect free-tier rate limits, cache results, and summarize detections for triage.10 min
  6. 06Analyzing JSON lines logs in Python: CloudTrail, Suricata, and app logs without a SIEMStream large JSON lines files, filter and group events with plain Python, handle nested fields safely, and write results for a timeline.10 min
  7. 07Reading packet captures with Python and Scapy for quick offline analysisLoad a pcap with Scapy, iterate packets, summarize talkers and DNS queries, and know when to switch to tshark or pyshark for speed and protocol depth.10 min
  8. 08Monitoring TLS certificate expiry with a Python scriptConnect to your hosts with Python’s ssl module, read certificate expiry and SANs, warn before expiry, and run the check on a schedule.8 min
  9. 09Running commands safely from Python: subprocess without shell injectionSee how shell=True with user input enables command injection, rewrite calls with argument lists, validate inputs, and avoid the same mistake in os.system and similar APIs.9 min
  10. 10A Python TCP service check for your own hosts: expected ports versus realityWrite a small script that connects to a list of your hosts and ports, compares results with an expected-state file, and reports unexpected open or closed services.9 min

Shell and automation

8 lessons

  1. 01Safer Bash scripts: set -euo pipefail, traps, and temporary filesMake Bash scripts fail loudly instead of continuing after errors, clean up with traps, create temporary files safely with mktemp, and log what the script does.9 min
  2. 02Quoting in shell scripts: why "$var" matters and how ShellCheck catches mistakesSee how unquoted variables split on spaces and expand globs, quote correctly, use arrays for argument lists, and run ShellCheck on every script.8 min
  3. 03jq tutorial for security work: filtering, selecting, grouping, and CSV outputUse jq to explore unfamiliar JSON, select events by field values, reshape objects, group and count, and export CSV for spreadsheets, using cloud and IDS logs as examples.11 min
  4. 04awk and sed for log processing: fields, filters, sums, and in-place cleanupUse awk to select columns, filter by conditions, and aggregate counts and sums, and use sed to extract or redact text, with web and firewall logs as examples.10 min
  5. 05Scheduling security scripts with systemd timers and cron, with logging and alertsRun your checks on a schedule as a dedicated user, capture output in the journal, alert on failure with OnFailure, and avoid the common cron pitfalls.9 min
  6. 06Stopping secrets before they reach Git: gitleaks, pre-commit hooks, and history scansScan a repository’s history for leaked credentials with gitleaks, block new leaks with a pre-commit hook and CI, and respond correctly when a real secret is found.10 min
  7. 07Semgrep tutorial: scanning code and writing custom rules for insecure patternsRun Semgrep with community rules, read findings, and write your own rules to catch patterns such as shell=True with variables, disabled TLS verification, and hard-coded tokens.11 min
  8. 08Applying a security baseline with Ansible: idempotent hardening for lab Linux hostsWrite an Ansible playbook that applies SSH hardening, a firewall, automatic updates, and audit rules, run it in check mode first, and keep it in Git as the documented baseline.11 min

PowerShell

2 lessons

  1. 01PowerShell scripting for defenders: objects, the pipeline, and exporting resultsUnderstand that PowerShell passes objects, not text, filter with Where-Object, shape output with Select-Object, and export audit data to CSV or JSON.11 min
  2. 02Collecting security inventory from many Windows hosts with PowerShell remotingUse Invoke-Command over WinRM to run the same read-only audit on several lab hosts in parallel, collect results with the computer name, and handle offline hosts.10 min