Scripting & Tooling

01 Why automate?

A manual task done once is a task. Done a hundred times across a /16 subnet, it's a liability — slow, inconsistent, and impossible to hand to a teammate. Scripting converts skill into an artifact: something that runs the same way every time, documents your method, and scales from one host to ten thousand without extra effort.

02 Python — the multi-tool

Python dominates security work because it reads like pseudocode, ships a large standard library, and has a mature ecosystem for everything from raw packet crafting to web automation. You can prototype a tool in minutes and still have it be maintainable.

The libraries worth knowing

Worked example — concurrent TCP port scanner

The standard library alone is enough for a usable scanner. This one uses a thread pool so it finishes in seconds rather than scanning serially, and takes its target and range from the command line.

scanner.py
#!/usr/bin/env python3
import socket, sys, argparse
from concurrent.futures import ThreadPoolExecutor

def probe(host, port, timeout=0.6):
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.settimeout(timeout)
        if s.connect_ex((host, port)) == 0:
            try:   banner = s.recv(64).decode(errors="ignore").strip()
            except OSError: banner = ""
            return port, banner

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("host")
    ap.add_argument("-p", "--ports", default="1-1024")
    a = ap.parse_args()
    lo, hi = (int(x) for x in a.ports.split("-"))
    with ThreadPoolExecutor(max_workers=200) as ex:
        for r in ex.map(lambda p: probe(a.host, p), range(lo, hi+1)):
            if r: print(f"[+] {r[0]:>5}/tcp open  {r[1]}")

if __name__ == "__main__":
    main()

Run with python3 scanner.py 10.10.10.10 -p 1-65535. For real engagements you'd reach for nmap (below) — but writing your own teaches you exactly what a connect-scan is, which is the point.

03 Bash — the workhorse

Bash is rarely where the logic lives, but it's where tools get connected. Its superpower is the pipeline: the output of one program becomes the input of the next, so a handful of small, focused utilities compose into something larger. Master grep, awk, sed, cut, sort, uniq, xargs and you can reshape almost any text.

The text-processing core

Worked example — a recon wrapper

recon.sh
#!/usr/bin/env bash
# usage: ./recon.sh targets.txt   (one host/CIDR per line)
set -euo pipefail                       # fail fast, catch unset vars
out="loot/$(date +%F_%H%M)"; mkdir -p "$out"

while read -r target; do
  [[ -z "$target" ]] && continue          # skip blank lines
  echo "[*] scanning $target"
  nmap -sV -sC -oA "$out/${target//\//_}" "$target" \
    | grep -E 'open|Nmap scan'
done < "$1"

echo "[+] results written to $out/"

04 Tool categories — what to reach for, and when

You don't need to memorise every tool — you need to know which category a problem falls into, then pick the sharpest tool in it. The table below maps the standard kit to the phase of work it serves, with the invocation you'll reach for most.

05 Deep-dive — nmap

Nmap is the recon workhorse. Knowing a handful of flags well beats knowing fifty badly. The scan type controls how packets are sent; the options control what else nmap does with what it finds.

full enumeration pass
# stage 1: fast — find which ports are open at all
nmap -sS -p- --min-rate 5000 -oN ports.txt 10.10.10.10

# stage 2: deep — version + scripts on just those ports
ports=$(grep open ports.txt | cut -d/ -f1 | paste -sd,)
nmap -sV -sC -p"$ports" -oA full 10.10.10.10

The two-stage pattern — a fast sweep to find open ports, then a slow deep scan on only those — is the single most useful nmap habit. It turns an hour-long -p- -sV into a couple of minutes.

06 Deep-dive — hashcat

Cracking recovers plaintext from a captured hash by hashing guesses and comparing. Whether it succeeds in seconds or never comes down to two things: the hash algorithm (fast hashes like NTLM fall quickly; slow ones like bcrypt resist) and the attack mode.

Common hash-type codes (-m)

cracking NTLM with a rule
# dictionary + best64 mutation rules against NTLM hashes
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r rules/best64.rule

# show what cracked
hashcat -m 1000 hashes.txt --show

07 Core concepts every script leans on

08 From snippet to capability

The difference between someone who uses tools and someone who builds them is a short feedback loop. The cycle is the same whether you're writing a 10-line wrapper or a full framework:

1. Research — find whether the tool already exists. Most do; standing on existing work beats reinventing it.
2. Build — write the smallest thing that solves your exact problem. Parameterise the parts that change.
3. Test — prove it in a lab against a known-good target before you trust it on a live one.
4. Harden — add error handling, timeouts, logging and a --help. This is what separates a script from a tool.
5. Deploy — use it in real work; let reality find the edge cases you missed.
6. Scale — wrap it in cron, a container, or a pipeline so it runs without you.