In this lesson,
we're going to start coding in Python.
Now, we're going to go a little bit quicker this time
because we've already spent a lot of time talking
about Bash and PowerShell,
and we're really going to talk about all the same functions.
The only difference is, what does the syntax look like?
Now in Python, if you want to comment something,
you're again going to to use the hashtag.
In Python though, there is no block commenting,
so you have to put the hashtag in front of every single line
that you want to be commented out
and ignored by the computer.
Next, let's talk about variables.
In Python, they tried to make
a very stripped down and easy to use language,
so there's not a lot of extra fluff or extra characters
when you're typing things out.
In the case of variables,
you simply give the variable a name and then equal a value.
For example, if I wanted to create a variable called price
instead of equal to 10,
I would simply type Price = 10.
Now, if you don't use quotes around the value,
this is going to be treated as a mathematical number
and in this case an integer
because I used the number 10 as the first value assigned.
Now, if instead I wanted to treat something as a string,
I would then put quotes around it.
I could do something like Vendor = "CompTIA".
Now in Python you can also use
a single quote or a double quote.
So, I could also do Vendor = 'CompTIA'
and that'll be treated as a string.
If I put a number inside of quotes,
that's also going to be treated as a string.
So if I set Vendor = "123."
That 123 is no longer a mathematical number,
but instead is treated as ASCII text
for me to able to do string manipulations with it.
Now by default, Python is going to assign
what it thinks is the best type of variable for you
when you do the initial assignment,
like we did with price and vendor.
But if you want to specify a certain type
for variable like a string, integer or a float,
you can do that when you initially assign the value.
You can do this by putting the variable equals the type,
parenthesis and then the value.
So, So price = int(42),
would say the price is now set to the integer 42.
Everything else that's ever going to be stored inside
that price variable would now be considered an integer
unless I reinitialize it with a different type.
For example, if I now wanted to use
floating point numbers or decimals,
I could do Price = float(42.00).
If I want to make the price now a string,
I could do that as well by typing it.
I would do Price = str("The life,
the universe and everything")
and then end parenthesis.
This now makes that a string variable
instead of being an integer or float variable.
Now in Python, when you want to display
or interact with a variable, you simply call it by its name.
So, price, vendor, customer name,
all of these are variables.
You don't need any special characters in front of it,
like a dollar sign, to call them like you did
in some of the other languages.
Now, you may be wondering,
how do I set a constant inside of Python?
Well, there actually isn't the idea
of a constant inside of Python.
So if you want to make a constant,
you basically are just going to treat it like a variable.
Now by convention, if we're going to treat
a variable as a constant,
we'll simply make it in all capital letters.
For example, PI= 3.14159
would now be treated as a constant pie,
but the computer will allow you to write
other values to this because after all,
it is only a variable.
The only reason we're treating it as a constant
is because we made it all capitalized
for us as humans to realize that we wanted this
to be a constant and not something
we're going to change throughout the rest of our program.
The next thing we need to talk about in Python is arrays.
Now, if you want to create an array,
you can create a blank array
by using something like tempArray =[].
Now if you want to put something in the array
when you create it, you can do that as well
by simply typing in something like
tempArray= [ Value1, Value2, Value3]
Now if those are numbers, you could put numbers in there,
but if they're strings, you're going to have to use
quote marks around each of those values.
For example, if I wanted to create a name array
that's going to contain the four names of
Jason, Mary, Joe, and Susan,
I can do that by typing in
nameArray= ["Jason",
"Mary", "Joe",
"Susan"]
Next, we have to understand
how to pull things out of an array,
and to do that we're going to use
the name of the Array[Position].
So, if I used name array[0],
that's going to give me the name Jason,
which was the first position
or position zero inside of that array.
Now in the other languages we talked about
associative and named arrays.
In Python, we don't use those terms,
instead we call it a dictionary.
If I wanted to create a dictionary
that's going to be a phonebook for us,
like I've done in the other languages,
I would simply type in PhoneBook= {},
As you can see when you're using a dictionary,
you're going to use curly brackets
instead of the square brackets.
So, if I'm creating a phone book with a key of name
and a value of Jason and a key of number
and the value of 321-1234,
I would do PhoneBook =, curly bracket,
quote, name, quote, equals, quote, Jason, quote, comma,
quote, number, quote, equals, quote, 321-1234,
quote, end curly brace.
Now, once I've done that,
you can then call out the thing you want
based on its key name such as
Phone Book["Name"]
and that would give me Jason.
If I did Phone Book ["Name"],
that will give me 321-1234 as my result.
Next, let's talk about comparisons.
In Python, they try to keep it very simple
and we use things that look like mathematical symbols
or if we're using strings and other characters.
When we want to do is equal to,
we test this by using two equal signs.
Now this is important because if I wrote something like,
a=b, I'm not actually doing a comparison.
If a=b, I just set A to the value of B,
just like I'm assigning a variable.
So in Python, you have to use the double equal sign
when you're doing the comparison.
So, A equals equals B will tell me, is A and B equal?
If they are, I get true.
If they're not, I get false.
Then we have the is not equal to.
There's two different ways to write this.
My preferred way is to use the exclamation equal sign
as the not equal to, but you can also use the less than
and greater than sign right next to each other
to be able to say not equal to.
So this would look like this.
A is not equal to B or A is not equal to B.
Next, we have is greater than,
and to do greater than you're just simply going to do
A is greater than B using the greater than symbol.
If you want to do greater than or equal to,
you'll simply use the greater than and then the equal sign.
So A is greater than equal to B.
If you want to do less than,
you'll just use the less than sign, A is less than B.
If you want to do is less than or equal to,
you'll use A less than equal B.
Now when we get to conditionals,
we have the IF statements just like we did before,
but in Python they're really simple to do.
If you want to do an if conditional statement,
you'll simply type in if the condition, colon,
and the next line will have the thing that you want to do.
For example, if I had the statement,
if a==b: print (a)
and the value of A and B are equal,
I'm going to display A to the screen.
Now notice I have indented the print command
in just a couple of spaces
to make sure it's easily identifiable
as part of that if statement.
This is important when you're doing Python.
Next, you can also do if else statements.
These take the form of if condition, colon,
then do something, else, colon, do something else.
If you want to do a multiple if conditions,
you can do that as well.
If condition, colon, then do something,
elif condition, colon, then do something else,
else, colon, do this thing instead.
Next, let's talk about flow control.
In flow control, the first one we have is the for loops.
Now for loops are going to be used to perform
a set of commands for each item in a list.
For example, if I have for X in list, colon, do something.
Let's say for example,
I set up an array called CertificationList.
It = [A, Network, Security,
CySA, PenTest and CASP.
Now for CertificationName in CertificationList:
print, CertificationName.
This is going to go through and create a list
of A, Network, Security, CySA, PenTest and CASP.
Now when it prints to the screen,
what is this going to look like?
Well, it's going to look like a mess
because they're all going to be smashed together.
In my print command, I only said to print the variable.
I never said to print a space, a comma or a new line
between each item in the list.
So you're going to get something
that looks like ANetworkSecurityCySAPenTestCASP,
all written as one word.
Next we have our while loops.
While loops are used to perform a set of commands
while a test condition is true.
For example, i= 1 while i< 6:
print(I)
I = i+ 1 print ("All done")
Now on the screen you should see, 12345All done,
because we went through that loop five times
before the value of I became six
and then six was no longer less than six
so we would stop working.
Now, in Python we don't have the idea of an until loop,
but you can instead create that functionality
by reversing the logic of your while loop.
For example, if you want to perform a set of commands
until a test condition is true,
you would simply set up the condition backwards
from what you initially wanted.
Consider the last example,
where I wanted to print the numbers starting at one
and counting up while I was still less than six.
Now, if I wanted to do this as an until statement,
I can instead say it this way,
print all the numbers starting at one
and count upward until I is greater than five.
Notice, this is essentially the same logic
as using an until command.
So, i=1, while , i >5: print(i)
i= i + 1 print (All done),
And again, I'm going to get the same results,
but now I'm testing the opposite condition,
but the results are still going to be 12345All done,
when I print them to the screen.
Next, let's talk about string operations.
String operations in Python are pretty easy.
You can have something like testString = "
Dion Training is helping me learn to code"
If you want to print that to the screen,
simply type print(testString,
and on the screen you'll see,
Dion Training is helping me learn to code.
Now if I wanted to add multiple strings together,
I can do that using the plus sign.
For example, let's say I had the command print(
testString, " in Python"
+ " today").
What is this going to do?
Well, it's going to take the variable testString,
which says, Dion Training is helping me learn how to code,
then add space, in Python, and then space, today,
and put all that in one line on the screen.
Now, when you're dealing with variables
that contain strings or strings themself,
you can also pull out certain parts of that string
by referencing the variable name of the string
and then adding the positions that you want to read from,
you do this by using brackets after the string.
For example, let's create a variable called MyName
and it's going to store a string as its value.
To do this in Python,
we're simply going to enter name= "and your name"
in my case, Jason, space, Dion.
Now, if I wanted to reference just a part of the string
from the variable MyName, I can type it as
MyName [X:Y].
X is going to be the position I want to start reading from
and Y is going to be the position
that I'm going to stop reading.
Now remember, the leftmost character is always going to be
position zero when you're looking at a string.
So, let's say I had MyName, bracket, zero, end bracket,
that is going to give me J,
because J is in the first position inside that string,
which we call position zero.
Now, if I used MyName, bracket, four, end bracket,
what's that going to give me?
It's going to give me N,
because I'm going to count up zero, one, two, three, four,
and that gets me J, A, S, O, N.
N is the fifth letter, which is in the fourth position
inside the string because computers start counting at zero.
Let's say I had something like MyName, bracket,
zero, colon, four, end bracket.
What is that going to give me?
It's going to give me J, A, S, O.
Notice, I'm not going to get the N here, now why is that?
Well, it's because I started at position zero, which is J,
and then I'm going to continue until I reach position four,
which is the N, but I'm not going to display position four,
I'm going to stop when I get there.
So I get J, A, S, O and I stop before printing out the N.
Next, let's say I had MyName, bracket, six,
colon, eight, end bracket.
What's that going to give you?
Well, if we look at our string of Jason, space, Dion,
the sixth position is the D.
So we're going to have position six and position seven,
but we're going to stop when we get to position eight.
So, we're going to have D, I and display that to the screen.
What do you think is going to happen
if I use a negative number?
Let's say I did something like MyName, bracket,
negative two, end bracket, what will I get then?
Well, I'm actually going to get the O from Dion.
Now why is that?
Well, because a negative number says
start reading from the end of the string.
So, when we start reading from the end of the string
with position negative one being the last character
or the N in my last name.
Position negative two is going to be the O in my last name.
And we can continue going from right to left,
negative one, negative two,
negative three, negative four,
all the way through until we get to the front of the string.
So, if I use something like MyName, bracket, six,
colon, negative two, end bracket,
what's that going to give me?
Well, it's going to start at position six, which was the D,
it's going to go to position seven, which is the I,
and then it's going to stop
when it gets to the position eight,
which is also equivalent to negative two position
if we counted from right to left instead of left to right.
So, we get the same thing with six colon eight
as we do with six colon negative two.
Now, let's do one more.
What's going to happen if I do something like
MyName, bracket, negative four,
colon, negative two, end bracket?
Well, this is going to give me the same thing.
I'm going to get D, I again,
because the negative four position
is four positions from the left.
So counting from the left, I go N, O, I, D.
So I'm going to start with the D
and then I'm going to go to the right
until I get to position negative two
and I'm going to stop
before I print out position negative two.
So really, I'm printing negative four and negative three
or D I in the case of this string.
I know that's a lot of information,
we've talk about strings and how you can read
different positions from them,
but this is something that you're going to do a lot
as a penetration tester when you're trying
to get certain pieces of information inside of a string.
For example, let's say you had an IP address
of 192.168.100.100,
and you wanted to figure out what the third octet was.
Well, you could do that by reading the string
IP, bracket, and then use these number positions
to be able to pull out just the three digits
that make up the third octet of that IP
and you can then compare that
in your script with other things.
Next, let's talk about input and output
from your keyboard and monitor.
Now, in Python you can get input
by using the keyword, input.
To do this, you're going to use something
like a variable name equals input, parenthesis,
and then some kind of a prompt to your user.
For example,userName= input,(
"please enter your name:")
Now when you go and ask for input,
you're saying, please enter your name.
When they do that, that's going to be stored
in the username variable.
Next, if we had something like print, parenthesis,
quote, hello, space, quote, plus, userName, plus, quote,
exclamation, quote, end parenthesis,
this would then show in your screen as,
please enter your name, colon.
When I entered in, my name of Jason,
it's then going to return, Hello Jason, exclamation mark.
That way we can combine the little strings that I added
inside of the quote marks with the variable name
that you just filled in when you entered your name.
Next, let's talk about files.
Inside of Python you can obviously write and read to files.
To write to a file, you first need to open that file
and assign it to a variable.
So, you'll use something like,
tempFile, equals, open, parenthesis,
quote, test.txt, quote, comma, quote, W, quote, parenthesis.
Now notice that W there,
that means I'm going to set it to a writing condition.
Write means I'm going to overwrite
any existing content in that file.
If I wanted to append to the file instead
of overwriting the file, I can change that W to an A.
And so, tempFile, equals, open, parenthesis, test.txt,
comma, A, parenthesis, and that A stands for append.
Now, you can also read or write
from network drives if you want to.
Now, if you want to read from a file,
you're simply going to change
that W or that A into an R for read.
And this is how you can interact with files.
You'll either set it to write mode,
read mode, or append mode.
Now, if you want to display the file contents to the screen,
you can do that using the print command.
You're going to use print, parenthesis,
the variable you assigned, in my case tempFile,
.read, parenthesis, end parenthesis, end parenthesis.
Notice we add this, .read to the end of the file
because we want to read from that variable.
Now, if I wanted to print maybe just
the first 50 characters in a file, I could do that as well.
Notice I had that parenthesis in the read?
That's where I'm going to put a number.
So if I do print, parenthesis, tempFile.read,
parenthesis, 50, parenthesis, parenthesis,
that is going to say read the first 50 characters
in that file.
Now, the other thing you can do
instead of reading characters would be to read lines.
And I like to actually read lines from the end of a file,
especially if I'm reading some kind of a log file
because I want to see the most recent activity.
So, let's say I wanted to read the last five lines
of a given log file.
I can do that in my script by using
print, parenthesis, temp file.readline,
parenthesis, negative five, parenthesis, parenthesis.
This will read the last five lines
or the most five current lines from that log file
that are written at the end of that file
and display them to the screen.
All right, I know that was a lot of information about Python
and I spent a lot of time especially talking
about how to manipulate strings.
The reason is those are important concepts
for you to know as a penetration tester
and it may be something you see come up on the exam,
so I want you to feel comfortable with it.
If this is your first time dealing with Python
and dealing with the way of calling out
different pieces of a string,
I do recommend that you open up your Kali Linux Machine
because in it there is a default
Python Interpreter already built in.
Just go into your terminal
and type Python at the command prompt.
Once you do that, you'll be in the interactive environment
and you can actually set something like,
MyName equals, and put your name,
and start playing with different character combinations
and position values so you can start trying to guess,
are you going to get the right answer
when you say, what is position five?
What is position five through seven?
And then you can type that command in Python
and it will give you the answer.
And so you can create as many
of these challenges as you want for yourself
and be able to make sure you're very comfortable
with counting out the positions for a given string
and identifying exactly where those characters are.