Course
Python for Security Engineers
Write real security tooling in Python: parse logs and feeds, drive subprocesses and HTTP safely, avoid deserialization traps, and ship CLIs that survive cron.
Parse the evidence
Read logs, hash files, and handle JSON/CSV from hostile sources without your tool dying first.
- 01Parsing auth.log: counting failed SSH loginsTurn raw syslog into a defensible report — named-group regexes, gzip rotations, and the bugs that ship.20mOpen
- 02Hashing files and walking trees with hashlib and pathlibChunked SHA-256, symlink-safe recursion, and a duplicate finder — the triage patterns you'll reuse weekly.20mOpen
- 03JSON, CSV, and data files that lie to youStream NDJSON, survive vendor CSVs with BOMs, and keep memory flat on multi-GB exports.22mMembers
Talk to the outside world
requests, subprocess, and feed polling — the network edges where security tools get owned.
- 01requests without regret: sessions, timeouts, and TLSTimeouts, retry policy, streaming downloads, and proxy/TLS pitfalls for unattended HTTP tooling.24mMembers
- 02subprocess without shell=True: wrapping CLI tools safelyArgv lists, exit codes, PATH scrubbing, and the argument-injection cases that still get through.24mMembers
- 03Scraping advisories and feeds politelyConditional GETs, RSS parsing, honest user agents, and dedup — polling that doesn't get you blocked.24mMembers
Ship it like a tool
Deserialization traps, real CLI packaging, and automation patterns that don't page you.
- 01pickle, yaml.load, and other ways to loseWhy unpickling external bytes is code execution, what to use instead, and how to fix existing caches.25mPremium
- 02Packaging a real CLI: pyproject, entry points, and pipxTurn a script into an installable tool — src layout, argparse subcommands, and distribution that survives teammates.30mPremium
- 03Automation that doesn't wake you at 3 AMLogging, atomic state writes, single-instance locks, bounded retries, and secrets hygiene for scheduled jobs.30mPremium