Free through lesson 3

Python Security for Beginners

From where the ethical and legal lines sit through sockets, HTTP, hashing and encryption, and log analysis, all the way to defending against SQL injection, XSS and CSRF. Thirty lessons that take you to the point where you understand attacks well enough to defend against them. Everything you touch stays inside a practice environment on your own machine (localhost).

Start from lesson 1 Unlock every course

Curriculum

The 30 lessons are grouped into six chapters. Working through them in order is the best way, but you are welcome to dip into whatever interests you. Note: lessons that use only the standard library run in the browser as they are. For lessons using sockets, Flask or third-party libraries, use the virtual environment you create in lesson 2.

Chapter 1 — Getting started (lessons 1–3)

You decide up front what is and is not acceptable, and prepare a practice environment (a local lab) that never reaches the outside world. You also revisit the Python you will use throughout, in a security context.

1

The ground rules of learning security, and the law

Why Python suits security work, and why an unauthorised scan is dangerous. Establishing the ground rule up front: your own environment and nothing else.

Free
2

Building a virtual environment and a local lab

Isolating libraries with venv and standing up a server that listens on 127.0.0.1 only. A practice environment whose traffic never leaves the machine.

Free
3

str and bytes, exceptions, and argparse

Why networking and hashing deal in bytes, and encode versus decode. Exception handling that does not stop on one failure, and argparse for restricting the target.

Free

Chapter 2 — Networking (lessons 4–9)

You open TCP connections with sockets and stand up your own server, so "the port is open" stops being an abstraction. You handle HTTP with requests, and finish with the etiquette and the law around scraping.

4

Opening a TCP connection with sockets

Getting clear on how IP addresses and ports relate, then writing connect, send, recv and close with sockets. Including timeouts and handling a refused connection.

🔒 Basic
5

An echo server, and what "an open port" means

Writing a server through bind, listen and accept. Establishing the premise behind scanning: the port opens the moment you listen.

🔒 Basic
6

Building a port scanner (localhost only)

Finding open ports with connect_ex. The guard that restricts the target to localhost, paired with why unauthorised scanning is a problem.

🔒 Basic
7

Sending HTTP with requests

The difference between GET and POST, and when to use params, data and json. Why you always add a timeout, and what you can learn from a response.

🔒 Basic
8

Status codes and security headers

How 2xx through 5xx divide up, and how to read res.headers. Checking for the main security headers such as CSP and nosniff.

🔒 Basic
9

robots.txt and scraping etiquette

Deciding whether you may fetch with can_fetch, spacing out requests and identifying yourself with a User-Agent. Drawing the line between "can fetch" and "may fetch".

🔒 Basic

Chapter 3 — Data and cryptography (lessons 10–13)

You learn to tell encoding, hashing and encryption apart and pick the right one. Tamper detection, storing passwords safely, and encryption with keys.

10

Base64, URL and hex encoding

Anyone can reverse Base64 without a key. Distinguishing encoding, obfuscation and encryption, and where URL encoding and hex belong.

🔒 Basic
11

Detecting tampering with hashlib

A hash is a fingerprint. Using the fact that one byte changes everything to detect a modified file. Including why MD5 and SHA-1 are out.

🔒 Basic
12

Storing passwords with bcrypt

Why SHA-256 is wrong for password storage, and what a salt is for. Verifying with checkpw, and safe comparison with hmac.compare_digest.

🔒 Basic
13

Encrypting with Fernet

Symmetric encryption, where the same key encrypts and decrypts, via Fernet. The basics of key management, and a final round-up of encoding, hashing and encryption.

🔒 Basic

Chapter 4 — Logs and detection (lessons 14–18)

You break access logs apart with regular expressions and aggregate them to find suspicious signs. You finish by assembling a small intrusion detection routine that combines several rules.

14

Parsing access logs with regular expressions

Reading the structure of one log line and breaking it into fields with named groups. Including skipping broken lines and checking the parse rate.

🔒 Basic
15

Finding anomalies in an access log with Counter

Pulling out the IPs with many 404s and the bursts of traffic using Counter. How to set a threshold, and detection that stops short of accusing.

🔒 Basic
16

Detecting brute force

Counting repeated login failures in a short window with a deque. Preventing duplicate alerts, and what to do once you detect one.

🔒 Basic
17

Working with IPs using ipaddress

Telling private from global, reading CIDR notation, and testing membership of a range. Writing an allowlist with no string comparison.

🔒 Basic
18

Building rule-based intrusion detection

Scoring IPs against several rules so overlapping signals surface. The trade-off between false positives and misses, and where it stops working.

🔒 Basic

Chapter 5 — Defending the web (lessons 19–24)

You stand up a practice app in Flask, safely reproduce SQL injection, XSS and CSRF, and learn how to stop each of them. Finally you draw out the principle behind all of it: never trust input.

19

Standing up a practice app in Flask

Building a lab on your own machine where vulnerabilities can be tried. Pinning host to 127.0.0.1 and sticking rigidly to never publishing it.

🔒 Basic
20

Reading authentication and sessions defensively

The difference between authentication and authorisation, and how cookies relate to a session ID. Protecting the pass with HttpOnly, Secure and SameSite.

🔒 Basic
21

Understanding and preventing SQL injection

Build SQL by string concatenation and the input rewrites the structure. Reproducing it in an in-memory SQLite and preventing it with placeholders.

🔒 Basic
22

Understanding and preventing XSS

Output input straight into HTML and a script runs. Preventing it with escaping and Jinja2's automatic escaping.

🔒 Basic
23

CSRF and defending with tokens

An attack that uses your signed-in state to act on your behalf. Embedding an unguessable token in the form, combined with SameSite.

🔒 Basic
24

Input validation and sanitisation

Validating type, length and format with an allowlist. Why a denylist always leaks, and why validation belongs on the server.

🔒 Basic

Chapter 6 — Practical tools and wrapping up (lessons 25–30)

You build password strength checking, breach lookups, and certificate and uptime monitoring, then pull them into one checker. Finally you cover how to write a report, where to go next, and the legal and ethical ground rules.

25

Building a password strength checker

Length matters more than complexity. Rejecting common passwords and scoring by length and character variety.

🔒 Basic
26

Checking for breached passwords with k-anonymity

Checking for a breach without sending the password or even its full hash. Send the first five characters of the hash and match the rest locally.

🔒 Basic
27

OSINT and the etiquette of public information

Resolving DNS with sockets while drawing the line between gathering public information and probing. Including the premise of never misusing what you gather.

🔒 Basic
28

Automating certificate expiry and uptime monitoring

Reading the expiry date with ssl's getpeercert and warning on days remaining. Uptime monitoring by connectivity, and running it on a schedule.

🔒 Basic
29

Pulling it together into a simple security checker

Splitting it into small check functions and a runner, with the guards in one place. Structured so you can add checks later.

🔒 Basic
30

How to write a report, and where to go from here

A report format built around reproduction steps, who to report a finding to, and practice grounds such as CTFs. Closing with the law and ethics.

🔒 Basic

Once you have finished all 30 lessons, build the thing you are defending in Django, or get to know the server side in Linux. Membership unlocks every course.