Python for Hackers

Because off-the-shelf tools eventually run out: a service with an odd protocol, a custom login, or a response you need to parse a certain way. Python's standard library ships with sockets, HTTP, regular expressions and threading, so you can build a working tool in a few lines without installing anything, even in an offline lab.

Create a socket, connect to a host and port, exchange bytes with send and recv, then close the socket. Almost every network tool is a variation on this one loop: a port scanner repeats it across many ports, and a banner grabber adds a recv to read the service's first reply.

A closed port actively refuses the connection, so your connect call fails quickly with a ConnectionRefusedError. A filtered port sits behind a firewall that silently drops packets, so your call waits until the timeout you set and then raises. That difference is useful information when scanning.

Sockets work in bytes, not text. You must encode strings before sending and decode bytes after receiving. Prefix a literal with b, as in b"hello", or call .encode() on a string and .decode() on what you receive. It catches almost every beginner once, then becomes automatic.

The goal is to demystify the real tools. Your hand-built scanner is slower and simpler than nmap, but after writing it you understand exactly what nmap does underneath, which makes you better at using it and reading its output, and lets you write a quick custom script when no existing tool fits.

Run a harmless service on the loopback address 127.0.0.1, which never leaves your own machine, then point your scanner at it. For example start python3 -m http.server 8000 in one terminal and scan port 8000 from another: it reports open while the server runs and closed once you stop it, giving you a true, lab-safe result.