A Project in Filling out Functions
Video Activity
A Project in Filling out Functions This lesson is a lab-based project in filling out functions. Participants will use a tool like FTP to transfer text files. This lesson utilizes the following commands for sending across the network: - Drive search Error search Upload Download Close Participants can follow along with the instructor as he programs ...
Video Description
A Project in Filling out Functions This lesson is a lab-based project in filling out functions. Participants will use a tool like FTP to transfer text files. This lesson utilizes the following commands for sending across the network: - Drive search
- Error search
- Upload
- Download
- Close
Participants can follow along with the instructor as he programs on the screen to complete the project.
Video Transcription
00:04
Hello and welcome to the final activity for the python for security professionals. Course I am your Smee and host Joseph Perry. And this is the final official activity for the course. When you completed this, who have completed the class, there is still some extra activities on the side. Ah, packet sniffer.
00:21
I'll be adding other
00:23
sort of extra activities over the next few weeks so that you can keep testing your skills and improving.
00:27
This is the final sort of test exam. If you want to say
00:32
practical section of the course
00:35
s O, you should have a file should look like this.
00:39
We're gonna just start right off.
00:41
So I was nice, and I want had named all of your functions for you had prepared those. So
00:46
all you're going to be doing for the course of this project is filling out these functions.
00:51
Uh,
00:52
pretty straightforward job. And then I've got this comment in the beginning that we're gonna go through now, and that's basically just gonna cover exactly what you have to do.
01:00
So the final activity for the advanced python section is a drive wide after p like tool. It's have to be like because it's only going to be designed. We're only going to worry about text files. We're not goingto
01:08
transfer J pegs executed is that sort of thing. That's possible, but it's not what we're doing.
01:15
Um, you should be able to receive multiple connections each on their own threat, and you should take several commands.
01:21
Dr. Searched their search, download, upload and close. The 1st 4 will be commands you actually send across the network and then close will be
01:29
just for your old machine there for your own
01:33
server
01:34
client. Whatever. Well, you can send it across the network for more proper tear down,
01:38
but the 1st 4 have to be sent across Pretty. It's
01:41
pretty straightforward.
01:42
So
01:44
the first thing we're gonna do with it,
01:46
this is with anything else is
01:48
framework or drop sort of the sketch of this program.
01:53
So you see that I've got ah read filer create file received at a send out a search Dr Search Directory. Send file contents received file contents, handle connection and
02:00
Maine.
02:00
You have handle connection because that's going to unnecessary. Later on, multi threat
02:05
received file contents and sent file contents obviously correspond to download, upload, download upload.
02:12
Search directories do research. Search drivers drive searched the primary distinction between Dr Search under surge door searches much faster, but much more limited. So well, it's not necessarily faster. If you were to install this program in your in the route, See, Dr, then they'll take exactly the same amount of time.
02:28
What Dr Search does is it searches from the top of the C drive all the way down,
02:32
and as soon as it finds the file, it returns.
02:35
Do research starts at whatever director you're ending goes down from there.
02:38
So this activity is going to require the use. Multi threading, see ties, regular expressions and some libraries with which are unfamiliar. Those libraries. You see, I've already imported. You're familiar with this. You're familiar with this committee with this? Not this. Well, maybe a little bit, but not much. And not really with OS, particularly
02:55
so s especially is going to be extremely handy in the search driving search directory sections.
03:01
So these 1st 4 frame worked First force or the outlines they make sense.
03:07
These next four are a bit different. So send and receive data
03:12
are going to be how we're going to send well, exactly Sound like Senate received
03:15
information there are also useful for commands.
03:20
The idea is pretty simple
03:22
if you
03:23
I want to send a command. If you want to send an uncertain length string and python, it's very difficult to do
03:29
buffers get big. You never know how much data you need to receive. And when you're sending files, you could be sending it kilobyte file or
03:36
to bite file. You never know,
03:38
so these are designed so that they can actually get the size of the data you're about to send or receive and properly receive it
03:44
with a correctly sized buffer. So we're going to We're really going to be doing with these two comment that now is
03:52
implement
03:53
a new networking protocol,
04:00
which sounds very intimidating, but it's a very, very simple networking protocol. It's actually, I would argue, the easiest part of this assignment straightforward. Create file this one, Of course, going to be done with C Types
04:12
and Read file is going to be done with C types. Well,
04:15
greatfire refile most of the stuff that's going to be done in this project you've already dealt with. You've already handled it. You've already written this code.
04:23
If you want to cheat and be a lazy person, you can just go back and scavenge code from old projects.
04:29
I'm not saying you should. I'm not saying you shouldn't. I can tell you that if you get deeply into programming that will become your favorite thing to do because it saves a lot of time. But we're going to do this from scratch so that you can see it being done.
04:41
Eso
04:43
we have our
04:44
you know, we have our functions. We have our return statement for all the functions so that we can compile or so he can run without
04:49
all the functionality actually being built. So the first thing we want to do now is
04:55
create our commands lists that we're gonna be handling.
04:58
So we're going to just call that command list,
05:04
and we're gonna run through. So Dr Searched research, download, upload clothes
05:29
who?
05:33
And I'm putting my quotes in a bit of a weird
05:35
order. We're putting in the mid a bit strangely
05:41
forgot him at the beginning. All right, so now we've got
05:44
commands. Listen, we're gonna break this out. Someone's a little neater.
05:51
That's the five commands of this contain
05:56
It is possible if you wanted to,
05:59
you know, be able to take shortened commands you could take. You could write
06:02
shorter command's list and mapped those these commands. That's totally up to you.
06:06
Um,
06:11
so you got
06:12
all these commands here. Now, what you want to start do it is implementing them in. See, There's really anything called a switch case Sable. And fortunately, we don't have that in Python, so we're gonna have to do a bunch of if statements, which is not awesome. But that's okay.
06:26
So,
06:29
command, I was gonna equal Ryan, but,
06:41
well, it's gonna be all right. But for now, in reality, what we're going to do is command's going to be
06:48
we're going to get it from across the network. So actually, we can
06:55
do command equals received data,
06:58
and we'll just give it
07:00
fake socket right now.
07:06
So then we're just gonna dorie of statement. We're gonna build our table with of commands. So if
07:14
equals equals
07:15
and one thing we're gonna do
07:17
Ah, here's we're going to actually use the upper function there. The upper method of a string
07:23
that way, when receive data returns, the string, which is gonna be What? It returns. Of course.
07:28
Um,
07:30
we get the upper case of it that way. We don't have toe check case or force the user to send us a specific case. We just deal with that ourselves.
07:38
So if command equals equals
07:42
Dr Search,
07:46
let me know we're going to
07:47
church, Dr.
07:49
And that's going to require a file name,
07:53
which we're going to get.
07:57
We'll just do it this way.
07:59
Uh, what I meant to do
08:05
this one we're not going to do upper on, because obviously not all files or upper case. So this will be case sensitive. It is possible to write this not case sensitive, which is a lot more work. Not really. Something we need to worry about right now.
08:16
So
08:18
well received data, and then she's gonna go through and do this with all of
08:22
command. Equals, equals Do research,
08:26
Search, search directory.
08:41
If command
08:43
equals download
08:48
send because we're the servers. Send file contents,
08:52
and that'll be file name, user sock, user info.
08:56
So again, we're just gonna give it,
08:58
but it's asking for. And then we're actually in to come through and do this a bit more properly. Well,
09:03
actually, we're not gonna do this and made when we're done, but that's coming up.
09:07
User suck.
09:09
So just suck.
09:13
No, no, to use herself
09:15
user info,
09:26
go through and change all these to use or suck.
09:33
So what we're doing right now, it's pretty straightforward is we're building, uh, the actual command's list in the actual command receiver. So normally, that would go in Maine, Which is why we're building in Maine right now. But we're actually going to take it out of here. We're going to put it in
09:48
this handle connection here in just a minute.
09:50
And I'll explain why although
09:52
some of you will probably understand why right out of the gate,
09:56
don't brag,
09:58
upload,
10:22
and then we are going to want to actually find out. So we're receiving data here, but we're not receiving data that has any information. So we're also going to do a sends data
10:33
qualities
10:35
with user sock
10:39
file named.
10:45
And as we go, we'll make this a little bit more robust and make things make a little more sense.
10:50
They're not necessary a little more sense, but make them a little more functional.
10:52
And the final command, obviously we're gonna take is going to be,
11:01
and we're going to do something here.
11:05
Bit exits.
11:07
Are you
11:07
our connection, handler? So again, normally, this would happen to me because it's the flow control. However, in this particular case, flow controls actually going to be done by Handel connection because each user is goingto have this and we don't want it to be locked up
11:20
for anyone.
11:22
So
11:24
control Exodus out of here.
11:26
We're gonna drop that in handle, connection,
11:28
race a little bit more sense.
11:31
Next thing we want to consider before we actually do anything with these commands is how this command process is gonna work. So if we receive one command right now, we're gonna receive the command. Then we're gonna do whatever it says that we're gonna leave. Obviously, we don't want that
11:45
so
11:48
well,
11:50
we're going to do a while,
11:52
and you could do it. True. A lot of people will do it true. I don't like doing while truce.
11:56
They don't really leave a lot of room for
12:00
proper closing.
12:01
So I like to do
12:03
continue
12:05
bull just variable. Basically saying shall I continue or should I not?
12:11
Some people call this essential value
12:15
whatever works
12:16
so continue, bull
12:20
equals false,
12:24
and we're gonna actually change that. True for its starting value.
12:30
So while continual bull brother
12:37
A ll this stuff
12:43
and then whenever you choose to close, it will just set, continue pulled a false that while Luke will exit and you're no longer taking commands
12:50
nice and easy.
12:52
There is one other thing that we want to account for is we have all the functions. They're all of the proper commands listed here,
13:00
but
13:01
well, first of all, the actual chiefs want to change all these. LF, but one of the other things we haven't really accounted for yet is what if they send us a command, That is it good?
13:09
Well, that's pretty straightforward. All we're going to do is we're going to do
13:13
and else down here at the bottom
13:16
and we're going to send data
13:24
invalid command.
13:28
So one of the nice things about
13:31
what we're doing years that were building these functions without regard to the fact we're without consideration thanked We actually don't have these variables
13:37
because we're just building a function of the time. We don't actually need those variables
13:41
we don't have to care about, um, while we're doing each function.
13:46
So now we've actually got pretty much,
13:48
at least at the prototype stage we have handle connection built.
13:52
So we're gonna work our way up. They're gonna come back down to maybe because man's gonna be kind of the trickier part, because that's what we're gonna do, some multi threading.
13:58
The next thing we're gonna do is we're going to do a received file contents. Soc File contents is
14:05
pretty straightforward. We get a file name and we got a sock a sock it.
14:09
And over that socket, we're going to receive contents of a file.
14:13
So the file name is going to be what we're going to create. And you see, we already have this create file. Well, let's create file here
14:18
so we don't have to implement Implement that in this function, which is nice. It makes it seem like we're not doing as much work. But of course we will have to do that work when we get to it. But hey, we'll cross that bridge when we come to it. So we're gonna do a create vile and again we could just do it with file name
14:33
and then
14:35
we're going to do
14:37
receive data.
14:39
User suck.
14:46
Nice and easy. Nice and straight forward.
14:48
One thing that we may want to do is
14:52
if that returned something invalid. So we'll say
14:58
negative one is going to be our air condition for the rest of this program
15:01
S O. If it returns. Negative one. If it says this, air it out, then we want to return. Then we want to actually send some data,
15:07
which will be saying
15:13
file creation failed.
15:22
So there you go. That's the received file contents. Nice and easy. Pretty straightforward.
15:28
They were gonna do send file contents. Same general idea
15:31
going to do
15:33
it will
15:35
send data.
15:39
You suck.
15:46
And
15:48
the arguing we're gonna pass. That is, when do you read file with the file name.
16:02
So
16:02
those are to download upload commands, they're pretty much done. We're going to revisit those a little bit later. Now we're gonna start digging into kind of the more difficult, more challenging ones. So do research is not something we've learned how to do before.
16:17
It's going to be one that uses this library here.
16:19
Uh,
16:21
gonna open a python interpreter over here.
16:23
Import os.
16:26
So what you want to do is in OS. There's a really fantastic, um,
16:33
method called walk
16:34
function, of course method.
16:37
Um, so we're gonna have a look at what that does.
16:41
We'll help, brother.
16:45
Okay, so
16:47
little crazy looking, but let's start at the top. So Walk has
16:51
four arguments. Top top down, which is auto set to troops on error, is none following Sequels False.
16:59
It's a tree generator. So it returns, innit? Aerator over. It returns a to pull rather
17:04
of this information here, which is Dirt path. Your name's file name.
17:08
So your path is a string. It's the path to that directory. It's the route pat specifically,
17:15
so starting at sea and then just going all the way down.
17:18
Uh, your names is a list of the subdirectories Inder path.
17:22
So whatever subdirectories exist here and file names a list of files that aren't directories
17:27
in your current director in the directory in which it's currently looking.
17:32
So it's a pretty
17:33
straightforward, pretty easy to use once you get the hang of things.
17:37
Always that walk takes
17:41
for Argument's is you mentioned Top Inder searches going to your current directory,
17:45
so we need to find a way to get our current record Well, let's see.
17:52
Let's try something along the lines of I know we're cheating a little bit since
17:56
kind of coming in. This was a priori knowledge, but, you know,
18:02
it's nice to be able to do that if you can't figure it out. If you don't know things like this, the easiest way is to just Google.
18:07
So there you go. So get current working director or get CWD returns the past your current working directory.
18:14
So let's walk top for this one. Top is going to be
18:18
os dot Get
18:19
CW deep
18:22
nice and easy.
18:22
No, start you on. It's gonna take his top down.
18:25
If the optional argument top down is true, we're not specified. The triple for the directory is generated before tripling any of its subdirectories. If it's false, it triples the directory after generates triples. For all the subdirectories,
18:37
top down is faster if you're looking for a specific file
18:41
for the obvious reason that if a file exists in your current directory
18:45
and you have to wait until you've gone through every single directory to actually start looking at the files,
18:49
that's gonna be slow.
18:51
So we generally want to leave top down it's true
18:55
military a very specific reason not to do
18:57
next. One is going to be on error.
19:00
So by default errors or ignored if you run into, uh,
19:04
permissions, aRer filed an existing somewhere, it just gets ignored. The reason for that is pretty straightforward. They're going to be Tom's of files. If you search from the C drive, we're going to be tons of files that you're not able to actually use.
19:18
Uh, that permissions, whatever.
19:21
And most of those areas aren't really handy. So on error generally equals none, because there's nothing you necessarily need to do. And we can revisit that if we find that there's actually some problem.
19:30
But for now, we can go with a safe non, and then the last one follow links is that's what it sounds like.
19:37
Follow links follow symbolic links on subdirectories. The danger of this is it says you're a caution
19:44
if you have Ah, subdirectory.
19:49
Um, actually, that's not the caution that I wanted, you see. So if you have a subdirectory that has a symbolic link to a directory above itself,
19:57
then you're going to hit an infinite loop. Knows Walk will never return it all go Terrible. So you generally don't want to follow links, So that's also gonna be false. So nice and easy. Most of these arguments are pre built for us. We can actually just not even put these in. If we want, we could just say, Oh, it's well, get current working directory.
20:14
Now, we mentioned us. Walk returns a triple. Ah, triple triple specifically or a three to pull.
20:19
So you don't have to say triple triple, which is kinda hard to say. So we're going to need to return all those values. So the first thing is going to return his dirt path. So we're gonna call that route because,
20:29
hey, I'm used to Lenox. Uh, your names will call that nurse,
20:34
and then file names will call that files
20:40
nice and easy, and then we're going to look in files. So this we're gonna bust out some ari
20:45
ari dot Compile. Luckily, this is actually super easy Ari to do ari dot compile file name
20:52
and I was going to do
20:55
of ari ob dje so that we have it actually returned somewhere.
20:59
So it's going to return a file name.
21:00
Um,
21:03
and they were going to search through
21:07
I n vials.
21:11
If I
21:12
We're gonna call this file name.
21:15
No, actually, we've already got a final name. That'll just get confusing.
21:18
If
21:21
Ari that search
21:23
and pattern is going to be our e o b j
21:26
string is going to be I and the flags,
21:33
we're going to return that file because that means we found it.
21:37
And super handy. It actually over here.
21:40
Screw that up to the tops of my highlighting. Doesn't work in python dopers.
21:45
Ah,
21:45
if you want to get the dirt path with the name combined in one handy string, all you have to do is OS path join.
21:52
So we're gonna do it o s dot path, not join
21:56
dirt path dot Nate, order path name. So that would just be route
22:00
file. Uh, root. I rather
22:03
and that's going to return the entire path to name.
22:06
Uh,
22:07
if we go through all of the files, we don't get anything that we're going to turn negative one, which is, remember, is our default air condition.
22:17
So that's searching The directory, um,
22:19
seems pretty easy, and we'll see if it runs in the errors in a little while. But for now, that's searching the directory.
22:26
This one searching the drive
22:27
is
22:29
pretty much the same. Except that its again a lot slower. So for this one, we're going to do root
22:37
yours files
22:38
equals O s dot walk O s. This is going to be C and double backslash, so we don't escape.
22:48
And then we're going to do the same thing with regular expressions, ari dot Compile
22:55
file
22:56
name
23:00
and then we're going to do for I and files
23:06
if you are in a search.
23:10
Sorry. Kobi Jane.
23:15
Hi.
23:21
Return
23:22
os dot path, not join roots.
23:25
Ah,
23:26
If that fails, return negative one.
23:33
So they're searching the directory and searching the drive quick and dirty, quick and easy. We use OS walk to travel through and find whatever and find all of the files.
23:44
And then when it finally returns, we go through and we compile,
23:48
uh, regular expression
23:51
and we track all of these eyes
23:55
and we hunt.
23:56
But there's actually a bit of a faster way to do this, and it's it's kind of a tricky one for that A lot of people wouldn't think of,
24:06
So they're a bunch of different ways we can do this, but again, we're getting generators back.
24:10
So what we actually want to d'oh
24:12
is do a second for Luke
24:17
for Rutgers files in OS Walk.
24:25
We're going to do that.
24:26
So what that's going to do is, rather than wait until it's all finished and, you know, have tons and tons of data to look through, which would take some more editing in and of itself, we're going to look through on every single return from O s walk. It's a lot faster to do it this way, and it's
24:40
relatively neat looking code.
24:51
There you go.
25:00
So the next we're going to do is dealing with the sending and receiving of data.
25:03
So sending data
25:07
is not exactly a Z Z is just doing sock dot Send
25:11
the reason for that.
25:15
The reason it's not quite that easy is because again, we don't know how much data were sending. So we're gonna send, we know. How much did it were sending? We don't really care how much it was ending, but the other side doesn't know how much state it's gonna receive so it could receive the wrong amount. Too much too little. It could wipe out the, you know, could receive commands later in the buffer could do all sorts of things.
25:33
So we're going to do to avoid that is we're going to get the length of the data and we're going to tell our far side
25:40
how much data to get.
25:41
We're going to do that First of all by
25:44
data, land equals leading data,
25:48
and we're going to do instruct
25:51
struck that pack.
25:52
And if you remember all the way back then
25:56
going to send in an imager
26:00
we're going to do,
26:12
we're just gonna put
26:14
data, Len
26:15
there,
26:15
actresses for sending this data. We can kind of cheat a little bit and just do socked out. Send
26:25
So what this is actually going to do for us and it's really, really handing is going to send the length of the data immediately followed by the data itself.
26:33
And this is the entire networking protocol that we just created. It's a very, very simple one. But it's one that makes python now a viable your regular link
26:41
language for network communications.
26:45
So when we received it, we now know what sending data looks like. So when you receive data, we just basically do the opposite.
26:51
We say data, Len,
26:53
we're gonna come in there because instruct is actually gonna unpack it to pull. Ah, Struck's
27:00
equal struck's
27:00
dot Unpack
27:06
socket. I perceive
27:08
four
27:08
because we know that an imager is going to be four
27:12
socket received four
27:17
and
27:26
and then data.
27:26
And then we can actually just
27:29
cheat a little bit
27:30
and just return
27:33
socked out. Received
27:34
data, Len.
27:38
So this is exactly what it looks like. We're just gonna get the exact thing that we packed a minute ago. We're going to unpack it into data, Len, and they were just gonna receive that amount.
27:47
That's an easy.
27:48
And then we get to create violent I create. Viable again is where we're gonna start using C types. Says where we're gonna implement some windows. A p I stuff,
27:56
um, stuff you're familiar with. If you did the other course are the other videos of this course.
28:02
First thing we need to do,
28:03
in any case, we're handling file, especially when we're actually creating violence.
28:07
Well, it sounds like create the file, so we know it's going to be windy, yellow
28:11
dot Colonel 32. And we know this because I did the slides, right? Hopefully
28:17
ah, Colonel 30 to create file A
28:21
and we know the first arguing to create Via Lay. Well, we might know the first argument create finally can independently are is
28:27
file name
28:30
and the rest of arguments. We're going to cheat, and we're gonna get off the Internet
28:37
and get it. We're here. Internet.
28:40
Here we are.
28:41
So
28:45
stick that over here for a minute.
28:48
The first few minutes file name is we mentioned. Second arguments going to be the desired access way. Obviously want all access,
28:56
which we remember is being zero x 1000000
29:02
Nice. We're gonna do share mode. We don't really want to share
29:06
sharing this for
29:07
late people. I guess.
29:08
So we're gonna do zero.
29:11
I'm not great. Come. I'm not great at insults. I admit it. So, yeah, uh, sharing is gonna be zero security attributes. This could be no, which is awesome because we love when it's no. Lola. 00 is easy.
29:22
And the creation disposition for creating a file we're going to do create always
29:29
another is a danger in this.
29:30
If we do create, if we caught this on a filing that already exists, we're gonna wipe that pile out.
29:37
Pardon me? We're gonna wipe that viol out. So it is optional. It's totally up to you if you want to do open always. Which means if I already exists, gonna open it just to upend.
29:49
I like to live life on the edge, so we're gonna create always. But again, it's up to you how you want to do it.
29:55
Flies and attributes obviously want to file a tribute Normal, which we read here is being zero x 80
30:03
I am
30:04
to do do do do do do
30:08
template file, which is again zero.
30:11
All right, so there's a created file.
30:14
And if we remember, we need a file handle
30:19
because that's what this returns which you see right here.
30:22
Turns out he's an open handle.
30:23
If it fails, the return value is invalid. Handle,
30:26
which I think has hidden somewhere is negative one.
30:37
Yep, native one.
30:42
So we can
30:47
file handle
30:48
because evil native one
30:53
return
30:56
negative one, which we soak immediately. Said as our error message
31:00
s So we've created a file now. We already received the data when this function is called. So we're next of course, going to write the file
31:18
first, we're gonna give the right file niceties. He's going to be the handle that we created just a minute ago, which is file handle. Next. Are you were going to give It is going to be a buffer
31:25
that buffers we see here, excavating the data to be written.
31:30
That's going to be data
31:33
number of bites, too, right?
31:33
Just going to eat.
31:36
Leading data
31:37
number by its written, if we remember, is an out that we have to have a pointer for
31:44
So we could do
31:48
data written.
31:52
You will see it zero
31:56
and was going to pass that by reference.
32:02
And then l p overlapped we're not going to worry about
32:06
after we write. And of course, we want to make sure we can check the return value. It functions seeds. It's non zero. If it fails, it returned zero.
32:14
So
32:17
we can do
32:22
mul success
32:28
that if
32:29
rule success
32:34
you zero
32:36
we returned
32:37
negative one because no matter what kind of error messages other people use,
32:40
uh, or no matter what kind of error messages your other functions use a function you call use. You want all of your error returns to be consistent within your own program. So anytime you have something that could return an error, make sure that you're returning the same,
32:54
uh,
32:55
sort of standard error. Or you can return specific error codes. However you do it, you just need to be consistent.
33:02
That's creating a file. So we see we create a file, we write a pile. Next thing for us that we need to do
33:08
is
33:10
so
33:12
I shall do that here.
33:15
Windy l l doubt Colonel 32
33:16
that close handle
33:19
because we never want to leave a handle open because that could be very bad.
33:22
Run out of resources,
33:23
which is not super likely to happen, but resource leaks are bad and we don't want resource leaks, so we'll be good. We'll get rid of it.
33:30
That's create piled up,
33:32
creates the vial with create, always disposition, and then it
33:37
rates the data.
33:39
This is going to read file, which is gonna be
33:43
almost exactly the same. Just instead of right file, we're gonna read file
33:46
and the creation disposition obviously will be a little bit different.
33:51
But otherwise it's pretty much the same function.
33:52
In order to create
33:54
file a
33:57
file name
34:00
directs 1000000 Jo Jo.
34:08
And for this one, we're gonna want to go ahead and do it.
34:17
We're gonna do open, always open existing. That'll be a three. You don't want to send them an empty file. So if they send us a file name that we don't have,
34:25
we're going to return in there. We're gonna say, Hey, that file doesn't exist.
34:30
So
34:34
and then
34:35
zero x 80
34:37
pilot Cherie, it's normal and zero
34:40
again, if I'll handle equals Negative one.
34:45
So this is the unfortunate fact of programming in general. Is that
34:49
a lot of the time, the code, your writing is that the super exciting code? It's just sort of
34:53
slugging through all the potential errors and problems and doing the boring stuff.
34:59
But the end result tends to be pretty awesome and worth the time.
35:01
So we're gonna do a re file.
35:09
So the reed file arguments are going to be similar to write follow, but not exactly the same.
35:15
So again it will be windy. L l Colonel 32
35:17
Colonel 32.
35:20
Read File
35:22
Handle
35:27
LP buffer LP Buffer, if you remember, is the pointer to buffer that receives the data
35:31
which we have to do a little bit of magic to create.
35:36
We'll call it data, since that seems to be a pretty consistent
35:45
variable named Terry. Oh, sorry. Blanked on my own
35:49
language. There
35:50
s so we'll call it data. And then we just have to
35:54
create a string buffer
35:57
which is create
35:58
string buffer,
36:00
and then the size that we want to put on that we can go ahead and say 40 96. It's larger than that. It's too large.
36:07
So read file, and then we're going to that's appointed to the buffet. So we're going to buy ref
36:12
data
36:15
D word. Number of bites to read. We know it will be 40 96 at most.
36:20
We need a pointer. Don't. Number of bites Red
36:22
Data red.
36:24
That's what I wanted to do.
36:30
You'll see int zero.
36:39
And then, of course, we by raft
36:42
data red
36:45
and then zero for l b overlapped.
36:50
And we see that this is a bull. If it succeeds,
36:52
turns non zero. If it fails, returned zero.
36:55
So bull
36:58
success.
37:20
Now, the return on this one's gonna be a little bit different since, rather than returning data in general, we're actually going to do a return of data dot value.
37:28
So we're just returning the actual text makes a little bit easier for python to Parsons.
37:32
So I've got actually, most of the sort of the code for the server is written. Now,
37:37
the final step for the server is going to be actually multi threading it.
37:42
I'm kind of going back and cleaning some stuff up later, but for now, it'll mostly be multi threading.
37:47
So
37:50
what do we do for multi threading?
37:52
Well, first thing, obviously, is going to be threatening
37:54
which, and we're gonna go ahead and close this up for a minute.
38:00
We can import are threating library,
38:04
and we're going to need to do threatening got thread. So let's go ahead and bring up helping help on that since
38:09
been a minute.
38:13
So we see group target name arguments, keyword arguments for boasts.
38:21
So
38:22
target we remember to be a function group. We want to leave his none.
38:25
So before you did
38:28
threading that thread,
38:31
none
38:32
target what we need to figure out a way to target.
38:36
Well, we know what the targets actually gonna be. We know it's going to be handled connection. We know, and we're going to handle the connection whenever we receive one.
38:43
That's not no one that should be done there.
38:45
So handle
38:45
connection,
38:47
and then it needs a name which again is going to be
38:51
done.
38:53
And he needs arguments. So the arguments that handle connection needs will be user socking user info,
39:05
uh, cured arguments none, and then verbose. None. So we could just
39:08
close it out there.
39:10
So that's the thread being created. But now we actually need
39:14
well, the cause of the threat,
39:16
because the threat is going to be receiving a connection. So
39:21
you gotta make some sockets
39:22
server sock.
39:24
He's going to eagle socket, not socket
39:29
socket that f i net
39:31
socket dot
39:34
Suck,
39:35
suck strange. It's gonna be obviously a TCP server.
39:39
We're gonna do a service sock
39:42
dot bind You could do in a report you like.
39:45
I'm going to go ahead but mine
39:46
on 55555 on the local office. Of course,
39:52
we're going to do server sock.
39:53
Listen,
39:55
and we give it eight
39:59
server sock dot except
40:06
and that's where we're going to get user sock
40:08
and user info. User sock is the actual socket user in vote is the address information.
40:21
So we've created a thread for handle, connection,
40:24
direction. God, stick up here
40:28
and that's really where it is.
40:30
And we're going to
40:35
start that thread,
40:37
which we can do by, Well, first, your reaction to give it a name
40:43
so we'll do.
40:45
Con threat equals threading, not threat. And then we'll do con thread dot
40:51
started
40:53
and now threads up.
40:57
So you see, we're passing control of the user socking user and go off.
41:00
And then, of course, all we've got to do is
41:04
while true,
41:05
and this time a while True is acceptable, since it's the actual sort of
41:08
just general running. We've got plenty of different things that we could put an exit in if we want to for clothes here or whatever.
41:15
The reason the server doesn't actually have any exit exit spots
41:20
is because it's a server just because one client dies or one client tries to shut us down. We don't want that
41:25
so
41:28
we can just say, you know what? We're safe. Without a close on this, we'll just leave it run
41:32
so it creates a sock in it, binds a socket, listens except
41:36
and then starts a thread using that accepted socket.
41:38
They're using that accepted client.
41:42
Now, we're just gonna walk through the logic of our program.
41:45
So
41:45
starts handled connection in its own thread with user sock user info,
41:50
handle connection. Receives data
41:52
from the client.
41:53
Uh,
41:54
obviously,
41:57
either the client's going to tell it. Give me a command or we're going to sell it. Give me command.
42:00
Uh, I prefer the server does all the work in the client is nothing but sort of an interface to it.
42:07
So we will do send data
42:09
and the user sock
42:13
command
42:20
so that we received the command. Then we say, Okay, let's say it's a drive search.
42:24
So we're going to send the user file name asking for the file name,
42:28
and they're going to send back
42:30
hopefully
42:30
the file name,
42:32
and
42:35
that'll be the end of it. So we actually have to
42:37
do a little bit more work. So what A search. Dr Return.
42:40
Well, hopefully, sir, strive returns the path.
42:45
So if search Dr.
42:49
Well, actually going to first of all,
42:51
uh,
42:52
search results
42:52
variable
42:55
if search results.
43:00
People, Sequels, native one.
43:07
Then we're going to send data
43:10
on user sock
43:14
file, not found
43:20
else.
43:22
But it's something.
43:32
Then we're gonna go ahead and do essentially the same thing for do research.
44:10
All right, so now we've got download. So we've got our searches or now
44:15
robust. They're capable of saying, Hey, something worked. Something didn't work. Whatever.
44:19
So now we've got download, so we send them a file name
44:22
that they want to get from us,
44:24
and then we send them to file contents.
44:30
So if the file contents fail, do we have a condition where they might fail?
44:37
Well,
44:38
it's right here, So file contents has just send data.
44:42
Well, hang on a minute.
44:44
Now we look at it and we say, OK,
44:45
we send data.
44:49
Okay, so we send data for file name, and then we receive data for the actual file name,
44:54
user sock, user info.
44:58
Then we attempts to send them
45:00
the file contents, which again is just a send data user saw Creed file
45:04
read file, of course, takes us. And this is what happened when youse are functions, arguments, you can kind of get into some deep nests.
45:09
Read file. We have.
45:12
Theoretically, it works. We wrote it all out, so we assume it works now because that functions done We don't have to relive through it every time.
45:17
So download is done.
45:19
Upload.
45:20
They sent us a file name and again, we just make it work.
45:23
Sort of. Melissa things. Servers should be good to execute.
45:28
Well,
45:29
now we contest that as soon as we have a client, which is going to be sort of a faster
45:34
But if code
45:37
create a new
45:40
and you will actually already have the clients.
45:44
So pause for just one second as I write the basic code for that.
45:49
All right, so So quick coding later and the client is ready to go. You will have the client, of course, available to you right out of gate. You won't have to coat it because this is actually just the same code. There's some minor changes to it to make it a client's, but in general is pretty much the same code. There's no reason for you to write it twice.
46:05
So now that we've written it and I made some minor corrections for those who didn't notice if you were like me, just kind of
46:09
parents of the code not paying too much attention.
46:12
Um probably missed. This should be windy. DLL Colonel there to do close handle. Oops.
46:17
And then in our actual Dr Walker down here
46:21
in with Os, get current working director, we need to call.
46:24
So all right,
46:25
now then, of course, any other areas that come up just, you know, take care of you. I trust you. So we're going to a python final server, not pi. Takes no arguments going to start running.
46:36
We're going to Python
46:37
final client dot pie
46:40
and then that one we're going to give an argument of. Well, first, all you can see what happens. You give it no argument. It's gonna say, Hey, we need a dress.
46:49
So given are you move 1 to 70 years or one that rob runs pretty ugly, but 1 to 7.0 point 0.1 That's low. Closed I p nice and easy.
46:57
And now what's command?
46:59
So
47:00
if we give it a bad commands, it'll just tell us it's an invalid command. Not really, Andy. So one thing that we might want to add you might want out in your own code or later iterations is an actual command list.
47:09
But we already know the command list. We're gonna shoot a little So first, the 1st 1 we're going to do is gonna be a long one
47:15
in the same dry air in the same directory that has the client has your client and server code in it. You should have a test file.
47:22
The test file
47:25
just says this is a test document. If you're reading this in a new doctor program works
47:30
nice and easy is the first thing we're gonna do is we're going to do a drive search.
47:32
You can read that All capsule a row, case
47:36
whatever Weird combo you want,
47:37
Dr Search. And it's gonna ask for a file name. We're gonna test dot t x t again. This is case sensitive, and it does require the file extensions to make sure you give both of those
47:49
stop t x t.
47:52
And that's gonna hang out for what?
47:53
So a reminder is that this Dr search is going to go all the way through the city directory. Everything in see? It's going to look for it.
48:00
That is a slow, slow process.
48:07
And we kind of just wait for a little while.
48:12
And there it comes up.
48:14
So see users. Joe documents, Jeannie advanced test dot text is the 1st 1 I found. So that's where we run into
48:22
is already a test document from a different code,
48:24
doing much the same thing.
48:27
So we go back to our final projects and let's try that again.
48:30
Let's see if it's going to find a different one. And again
48:32
it takes a little while running. Nice thing about this is because you're running it in a python interpreter. It actually remembers the commands. You give it
48:38
pretty quick and easy. Pretty handy Drive, search
48:43
file name,
48:45
test, that text
48:47
thing
48:49
and we wait.
49:07
We're all awaiting Those of you interested in this sort of security worker and security work in general may check out some of the other class here inside. We're not I ti umm of course, one of them I taught, which is the post exploitation hacking. It's sort of a tool demo,
49:19
um, for a lot of the different things that you would use in the post extradition process.
49:23
Turns out, while I was talking, it finished. And now it found it in the photo we looking in that is one of the dangerous is that with this regular expression it on Lee looks for the first iteration of a file.
49:35
There are tricks associate with that ways to avoid it. But again, this is a pretty simple, basic project.
49:42
We don't want to go too far overboard, So Okay, now we know test that text exists.
49:45
So let's try
49:47
downloading it.
49:52
And the plan will ask you for a local file name so that if you're testing on one machine, you don't just override it and you wouldn't be able to tell if it works. So you're gonna download, test that text into test one dot text and we just hit enter
50:05
and look at that
50:06
test one was created.
50:09
We're going to try uploading,
50:12
and that's going to be
50:13
test one. Got text
50:15
into tests,
50:17
two
50:19
got text,
50:22
and there you go.
50:22
So now we've got three different test files, all which you can see we're properly created. So we know those functions work.
50:29
Obviously, we still want to do do research. Just make sure that works.
50:36
Sure enough, the show's immediately were test out. Texas.
50:38
So what happens if we give it
50:40
a bad file name?
50:43
Well, first of all, I could give it about file naming the command's list. It's gonna tell us? No.
50:46
During surgery, you had a bad file name. It's a file not found.
50:50
We're not gonna do that with Dr Story because it will search for a very long time and try and find it for us.
50:54
What if we did? Ah, download
50:59
on a bad file name?
51:00
Look at that. So it says there's a breakdown here. Something didn't work that we wanted it to
51:07
and everything falls apart.
51:08
So we found an issue. We found a bug,
51:12
and this is one of those insidious bugs that's really hard to track down,
51:15
but we're gonna have a go at it.
51:17
So we know that the data went all the way here and we see that the air came up in line 60 and send data. So what called that line 82.
51:24
Send file contents.
51:28
Is this right Here?
51:29
Read. File. File name.
51:32
There's no data.
51:35
Ah, well,
51:36
that's one of the air conditions.
51:38
Problem is that we didn't actually give it
51:40
anything to do with that air condition.
51:44
Send file contents right now is a pretty empty
51:46
function.
51:49
So
51:50
pretty easy to fix. That
51:52
date is now going to equal
51:54
the return from Reed file.
51:58
If data
52:00
data
52:01
people see
52:06
just killing python, there s so if if data equals negative one,
52:10
we're going to return. We're going to send find found. Otherwise, we're just going to send the data.
52:15
So we do Python final serve it up. I
52:19
by the final client not pie
52:21
command
52:22
download,
52:29
and it doesn't seem to work.
52:30
Well, why is that
52:34
so, David, who's equals negative one? We're gonna send data
52:37
that seems right.
52:38
Planet served up high line 85. Lyon 85 is the issue.
52:52
Okay, read file. File name.
52:54
So we're going to try and open the file. But I was not there. Then we return negative one.
53:05
If it can't read the file here,
53:07
return negative one.
53:07
So it seems the returning a good one.
53:09
Well, obviously, the easiest way to figure that out for sure is just going to be
53:14
to print what
53:15
that returns.
53:17
So we're just gonna print data
53:22
and again we're gonna do our little
53:23
Tess killed.
53:24
I am python dot xy
53:28
f
53:30
handy trick,
53:31
but the final server python pile client
53:37
download.
53:40
Right.
53:45
So we look, it sure is negative. One prints, negative one. So what's the issue?
53:50
Data equals equals negative one. We should send a file not found.
53:55
And yet for some reason, we're not
53:59
interesting problem.
54:00
Ah, well,
54:01
who's to say for sure that we're not?
54:04
In reality? What's happening is that whether or not we send data file, not found or not,
54:07
we don't return. We have an issue there, so we need to return Negative one.
54:22
This is the sort of thing that you're going to get used to when you're doing testing on software,
54:28
tons and tons of quick changes and see if it works
54:34
areas. Now, I've got a print file not found,
54:38
and it doesn't work down here.
54:47
The reason for that is
54:52
wrong
54:52
folder there,
54:54
Jeannie Dance Project
54:57
is that it did create the local file.
55:00
So that's a bit of a bug in the code. But if we open the local file with
55:05
anything
55:07
new, we're gonna see us is filing a pound.
55:09
So it's still spits out the air and everything works. So now the server is
55:14
functional again, and it's saying, Hey, there's a problem.
55:16
Awesome.
55:19
So we're not going to get sent data that doesn't exist when I can have a breakdown on that.
55:22
Obviously, we know,
55:24
uploading is sort of the clients job. So you're not gonna have to worry about that. Any bugs and that in your server, other than making sure you actually
55:31
do created which we make major of earlier.
55:35
So with that, the surface is actually done.
55:37
Now, there are some clean up things that you can do to make it a little bit prettier. Um, change what? Your commands are taking more commands, that sort of thing.
55:45
But with that, you've actually completed the server. And with the server, you've completed the final task in this class
55:51
on the final
55:52
primary task.
55:54
So to sort of recap what we did in this in this server recovered sockets we cover multi is threating,
56:00
which was actually ended up being quite a bit easier than you might have expected. We cover multi threading we covered.
56:07
See types, file creation, all sorts of things.
56:09
Um, if you have any questions about this there any question about any of the class I've taught or any of those videos in this class Or if you'd like more information, please. Police police were called for you to contact me on my page on cyberia. Got I T.
56:21
Uh,
56:22
if you've enjoyed this class, recommend it to your friend shared on Facebook's and emails how you communicate smoke signals. I don't judge whatever works for you. Works for us.
56:30
Just get the word out and let other people learn how to be python security professionals, just like you now are.
56:37
So congratulations on completing the course.
56:38
Thank you for taking the time to watch it. Thank you for taking the time to do these
56:43
practice exercises if you did them. Thank you for watching if you didn't
56:46
and as always, do your best to get out there and break some stuff.
Up Next
Python for Security Professionals
This is the archived version of our new Python course! If you would like to view our newly updated course, scroll to the bottom, and click the link.
Instructed By
