It wouldn't be a security course if we didn't discuss
encryption and hashing functions.
The two main modules I want to discuss are base64 and hashlib.
Base64 needs to be imported and pretty much does what you expect,
encode or decode a string in Base64.
Base64 is very common in websites to embed heavy amounts of data into a short,
quick string.
It is also used to convert binary to ASCII strings for storage and transfer.
In this demo,
we're taking a look at the string Hello my name is Michael
Woolard and encoding it into a set of bytes.
The b64encode function processes these bytes and now puts a
Base64‑encoded set of bytes, which we now run through a decode
function to produce the string to be printed.
The second part of this is to decode this Base64‑encoded string back
to the original text by reversing this process.
When I run the script, you will see I have my original text,
the Base64‑encoded version of that string, and then back to the
original string. Now onto the hashlib module,
basically the same principle, but there are a few options to consider.
I lay two of them out here with SHA256 and MD5, neither of which should
be considered strong for storing passwords, but are the two functions I
pull out of the library to help demonstrate.
We start this demo by importing the hashlib module and assigning a string
value to the str variable. Hello My Name is Michael Woolard.
Same as with base64, I have to encode the string into a set of bytes
that allows me to call the string with the sha256 function. Now in
this print statement here on the end,
I am using the hexdigest function, which converts the output back
into a string that can be printed on the screen.
Here's the SHA256 value of my Hello My Name is Michael Woolard.
Now let me switch the comments. And here is the MD5 value of that
text. MD5 is interesting because it is commonly used both online
and offline for integrity purposes.
Never confidentiality anymore.
MD5 is beyond broken at this point. But one use of MD5 is when you're
downloading software. You want to verify no one has tampered with the
file before it made its way onto your machine.
Software distribution services often provided an MD5 hash
value of the file for you to compare to download a file
against. Now back in this demo,
let me comment out some of the top sections first and open up the bottom
for processing. As you see here, I am first printing out the hash that
comes from the website I downloaded the file from and then looking to
open the Python install file with this rb option so it assigns it to the
f variable as a set of bytes. The code then runs the bytes through the
hash function,
which then spits out the MD5 value of the application I just downloaded. When
I compare it to the hard coded hash from the website, I see they match and we
are good to sign off that the downloaded file has integrity. Not a bad little
tool you can provide your team to verify documents before they are opened on
the desktop. In review,
you'll be working with all sorts of data types in your security
projects. Knowing how to handle that data,
how to convert the data to work with the functions you need
to use, and how to gather, group, and sort the data is a big
step forward. To get the data,
we have to understand how to work with the files that contain the data.
There are all sorts of built‑in functions to opening,
reading,
writing, and deleting files. Use this to your
advantage to automate malware analysis,
log processing or writing and parsing things like CSV documents.
The ability to kick off a new process is a huge
advantage of Python over other languages.
A phishing email with an attachment came in,
your script can now automate the process to kick off a
scan with various tools of your file,
then start your sandbox to further break down the macros built into it.
Finally,
encryption and hashing. What security pro doesn't touch these regularly?
Personally, I generally get more into this area with my web application
assessment work on that side of the house, but I pull all sorts of tokens and
cookies out and process them and learn how they are constructed and recreate
the token with the information I was passed.
We'll talk a little bit more about this topic towards the end of this
course when we start to get into the discussion on monitoring net
trafficand sockets and dealing with the encryption there.