🛡️Cyber Security
Foundations · Lesson 5/9

Python — The Security Automation Language

40 min 3 exercises 1 quiz Graded labs: 1

What you'll learn

  • Why Python is the #1 language for security work
  • Variables, lists, loops, and functions — the core toolkit
  • Regular expressions (regex) — finding patterns like IPs and emails in a sea of text
  • Write real security-flavored scripts, checked live
  • Everything runs in your browser via Python (Pyodide)

The Swiss Army knife 🔪

Security people automate everything: scan 10,000 IPs, parse a million log lines, test 500 passwords. No one does that by hand. Python is the tool of choice because it reads almost like English and has a library for everything.

The essentials, fast:

# variables
target = "10.0.0.5"
port = 443

# lists — an ordered box of things
ports = [22, 80, 443, 3306]

# loops — do something for each item
for p in ports:
    print("Checking port", p)

# conditions
if port == 443:
    print("This is HTTPS")

# functions — reusable recipes
def is_common_port(p):
    return p in [22, 80, 443]

Notice Python uses indentation (spaces) to group code — the lines inside a loop or function are shifted right. No curly braces.

For security specifically, you'll constantly loop over lists (IPs, ports, users), check conditions (is this suspicious?), and wrap it in functions you reuse. Master those four and you can automate 80% of grunt work.

Exercise 1

Write a function find_open_ports(scan) where scan is a dictionary mapping port numbers to "open" or "closed". Return a list of the port numbers that are open.

Example: {22: "open", 80: "closed", 443: "open"} → [22, 443]

Open in Code Lab
Exercise 2

Password strength checker — a real security utility. Write is_strong(pw) that returns True only if the password:

  1. Is at least 8 characters long
  2. Contains at least one digit
  3. Contains at least one uppercase letter
Open in Code Lab

Regex — finding needles in a haystack of text 🔍

Log files are huge and messy. Searching for an exact word (like "ERROR") is easy — but what if you need to find any IP address, without knowing which ones appear? Regular expressions (regex) describe a pattern instead of exact text:

import re

text = "Login from 192.168.1.5 failed, then 10.0.0.9 succeeded"
ips = re.findall(r"\d+\.\d+\.\d+\.\d+", text)
print(ips)   # ['192.168.1.5', '10.0.0.9']

Read the pattern \d+\.\d+\.\d+\.\d+ piece by piece: \d means "any digit," + means "one or more of those," and \. means "a literal dot" (a plain dot in regex means "any character," so it must be escaped). Put together: "one or more digits, a dot, one or more digits, a dot…" — exactly the shape of an IPv4 address.

This is a genuinely core security skill: SOC analysts and SIEM tools (you'll meet these in the SOC lesson) run regex patterns like this over millions of log lines to pull out IOCs (Indicators of Compromise) — suspicious IPs, email addresses, file hashes — automatically, instead of reading every line by eye.

Exercise 3

Write extract_ips(text) using re.findall that returns a list of every IP address found in text.

Open in Code Lab

Lab exercise 1

PythonGraded in Code Lab

Hunt the brute-forcers. An SSH server writes one line per failed login, like:

Oct 05 03:12:01 sshd[311]: Failed password for root from 203.0.113.9 port 51022

Read from standard input: the first line is a threshold N, every other line is a log line. Count the failed logins per source IP (lines that say Failed password for invalid user <name> from <ip> count too; successful logins and other lines are ignored).

Print every IP with at least N failures as IP COUNT, most failures first (ties: lower IP text first). If no IP reaches the threshold, print no suspects.

Visible tests (4)
  • Flags the repeat offender
  • Counts invalid users and sorts by count, then IP
  • Prints no suspects below the threshold
  • Handles a log with no failures
Example run
Input
3
Oct 05 03:12:01 sshd[311]: Failed password for root from 203.0.113.9 port 51022
Oct 05 03:12:03 sshd[311]: Failed password for admin from 203.0.113.9 port 51024
Oct 05 03:12:05 sshd[311]: Failed password for root from 203.0.113.9 port 51026
Oct 05 03:14:40 sshd[402]: Accepted password for alice from 198.51.100.7 port 40110
Oct 05 03:15:12 sshd[455]: Failed password for bob from 198.51.100.23 port 40300
Expected output
203.0.113.9 3
Starter code
import re
import sys

lines = sys.stdin.read().splitlines()
threshold = int(lines[0])

# TODO 1: count "Failed password" lines per source IP (a regex with a capture group works well)
counts = {}

# TODO 2: keep IPs with count >= threshold, sorted by count (high first) then by IP text
# TODO 3: print "IP COUNT" per suspect, or "no suspects" when the list is empty
Try in Code Lab

Hints and instant feedback are in Code Lab. Optional practice: it does not block finishing the lesson.

JavaScript and Python also run in your browser without an account; other languages use the secure server runner and need a free account.

Quick quiz

Question 1 of 5

How does Python group code inside a loop or function?

Question 2 of 5

What does any(c.isdigit() for c in pw) check?

Question 3 of 5

Why is Python popular for security automation?

Question 4 of 5

What does \d+ mean in a regex pattern?

Question 5 of 5

Why do SOC analysts use regex on log files?

Summary

  • Python = the automation language of security
  • You mastered variables, lists, loops, conditions, functions
  • Regex finds patterns (IPs, emails, hashes) instead of exact text — the engine behind SIEM log analysis
  • You built a port filter, a password-strength checker, and an IP extractor — all real tools

Next: Cyber Security Basics — the core concepts (CIA triad, threats, defense) that turn these skills into a security mindset.

Practice

Reading is not learning until you run something. Pick one.

Graded lab exercises

Open an example in Code Lab

Challenges for this lesson

Blank Code Lab in Python
Previous
Linux — The Hacker's Operating System
Next lesson
Security Basics — The Defender's Mindset