Find cybersecurity home lab essentials setup and hands on

Automation & Scripting for Efficiency in Cybersecurity Home Labs

Python Scripting for Repetitive Tasks

Port Scanning with `socket` and `concurrent.futures`
A multi-threaded script scans multiple targets for open ports, improving efficiency over sequential scans. Below is a modular example using Python’s built-in modules:

import socket
import concurrent.futures
from typing import List, Tuple

def scan_port(target: str, port: int, timeout: float = 1) -> Tuple[str, int, bool]:
"""Check if a port is open on a target."""
try:
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
s.settimeout(timeout)
result = s.connect_ex((target, port))
return (target, port, result == 0)
except socket.error:
return (target, port, False)

def scan_targets(targets: List[str], ports: List[int], max_workers: int = 100) -> None:
"""Scan multiple targets and ports concurrently."""
with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as executor:
futures = [
executor.submit(scan_port, target, port)
for target in targets
for port in ports
]
for future in concurrent.futures.as_completed(futures):
target, port, open_status = future.result()
print(f"{target}:{port} {'OPEN' if open_status else 'CLOSED'}")

# Example usage:
scan_targets(["192.168.1.1", "10.0.0.5"], [22, 80, 443, 3389], max_workers=50)

Log Parsing with Suricata and Zeek
Correlating logs from IDS/IPS (e.g., Suricata) and network analysis tools (e.g., Zeek) requires structured parsing. The following script extracts and correlates alerts with connection data:

import json
import pandas as pd
from pathlib import Path

def parse_suricata_alerts(alert_path: str) -> pd.DataFrame:
"""Parse Suricata JSON alerts into a DataFrame."""
alerts = []
with open(alert_path, "r") as f:
for line in f:
alerts.append(json.loads(line))
return pd.DataFrame(alerts)

def parse_zeek_connections(conn_path: str) -> pd.DataFrame:
"""Parse Zeek connection logs into a DataFrame."""
return pd.read_csv(conn_path, comment="#", sep="\t")

def correlate_alerts_with_connections(alerts_df: pd.DataFrame, connections_df: pd.DataFrame) -> pd.DataFrame:
"""Join Suricata alerts with Zeek connection data."""
merged = pd.merge(
alerts_df,
connections_df,
left_on=["src_ip", "src_port", "dst_ip", "dst_port"],
right_on=["id.orig_h", "id.orig_p", "id.resp_h", "id.resp_p"],
how="inner"
)
return merged[["timestamp", "src_ip", "dst_ip", "alert.signature", "proto"]]

# Example usage:
alerts = parse_suricata_alerts("/var/log/suricata/fast.log.json")
connections = parse_zeek_connections("/var/log/zeek/conn.log")
correlated = correlate_alerts_with_connections(alerts, connections)
print(correlated.head())

Generating Custom Reports from Tool Outputs
Tools like Nmap, Nikto, and BloodHound produce structured or semi-structured output. Python scripts can aggregate these into actionable reports. Below is an example combining Nmap and Nikto results:

import xml.etree.ElementTree as ET
import json
from collections import defaultdict

def parse_nmap_xml(nmap_path: str) -> dict:
"""Extract host and service data from Nmap XML output."""
tree = ET.parse(nmap_path)
root = tree.getroot()
hosts = defaultdict(dict)
for host in root.findall(".//host"):
host_ip = host.find("address[@addrtype='ipv4']").attrib["addr"]
for port in host.findall(".//port"):
port_id = port.attrib["portid"]
service = port.find("service").attrib
hosts[host_ip][port_id] = service
return hosts

def parse_nikto_json(nikto_path: str) -> dict:
"""Extract vulnerabilities from Nikto JSON output."""
with open(nikto_path, "r") as f:
return json.load(f)

def generate_report(nmap_data: dict, nikto_data: dict, output_path: str) -> None:
"""Combine Nmap and Nikto findings into a structured report."""
report = defaultdict(list)
for ip, ports in nmap_data.items():
for port, service in ports.items():
if service.get("name") in ["http", "https"]:
report[ip].append({
"port": port,
"service": service["name"],
"vulnerabilities": [
vuln for vuln in nikto_data
if vuln.get("host") == ip and vuln.get("port") == int(port)
]
})
with open(output_path, "w") as f:
json.dump(report, f, indent=2)

# Example usage:
nmap_data = parse_nmap_xml("nmap_scan.xml")
nikto_data = parse_nikto_json("nikto_scan.json")
generate_report(nmap_data, nikto_data, "combined_report.json")

Command-Line Tools Reference Table