Almost every security tool you will use is either written in Python or scriptable from it, and the moment a task becomes repetitive — request this URL a hundred times, parse this JSON, try each word in a list — the answer is "write a few lines of Python". You do not need to be a programmer to benefit; you need a small, reliable set of building blocks. This lesson gives you exactly that set, starting from zero.
This is the Python branch of the scripting track. bash-scripting-primer covers the shell-glue side, and programming-scripting-for-pentesters later puts both to work by automating repetitive testing and reading the JavaScript an application ships to the browser. Here we stay on Python and HTTP.
Why Python specifically? It reads almost like English, it ships with a huge standard library, and the third-party **requests** library makes talking to a web server trivial — which is most of what a web tester automates. It has become the lingua franca of security tooling, so being able to read and tweak a Python script is a core skill in its own right.
In this lesson you will:
- Meet the building blocks — variables and the core types (
str,int,list,dict), conditionals (if/else), loops (for/while), and functions — the pieces every script is assembled from. - Print and format output with f-strings (
f"status: {code}"). - Use the **
requests** library to make HTTP calls —getandpost, queryparamsandheaders, and the response attributes you read most:.status_code,.text, and.json(). - Install it in one line (
pip install requests, ideally inside a virtualenv) and write a real five-line script that GETs a NovaCart URL and prints what came back.
The building blocks at a glance
A variable is just a name for a value: target = "https://target.example". The core types you will use constantly:
- **
str** — text, in quotes:"admin". - **
int** — a whole number:200,3000. - **
list** — an ordered collection in square brackets:paths = ["/", "/admin", "/api/users"]. Loop over it; index it withpaths[0]. - **
dict** — key→value pairs in curly braces:headers = {"Authorization": "Bearer xyz"}. Look things up by key:headers["Authorization"]. Parsed JSON arrives as dicts and lists, which is why this type matters so much for web work.
Everything else — loops, functions, HTTP responses — is built on top of these. Send the Continue signal and we will wire them together.