Building a security tool exposes the engineering decisions hidden behind mature scanners: input parsing, timeouts, concurrency, protocol fields, error handling, and result filtering. This hands-on course uses Python to develop focused network reconnaissance utilities and connect their outputs into a repeatable workflow.
You will create a multithreaded TCP connect scanner, construct ICMP and TCP packets with Scapy, and build a concurrent web-directory enumerator. A final challenge scans a local web-port range, runs wordlist-driven discovery against each open service, and writes the combined findings to a report.
What You Will Learn
- Build a command-line interface with
argparsefor target and port-range input - Detect open TCP ports with
socket.connect_ex, timeouts, and exception handling - Compare sequential scanning with thread-based concurrency and wait for worker completion
- Stack IP, ICMP, and TCP layers in Scapy and inspect packet fields
- Send one ICMP probe with
sr1and handle either a reply or timeout - Read directory candidates from a wordlist and issue concurrent HTTP requests
- Filter discovered endpoints by selected HTTP status codes and handle request errors
- Chain port scanning and directory discovery into a localhost reporting tool
Who This Course Is For
This intermediate course is for cybersecurity learners, network engineers, and Python developers who want to understand how basic scanners and enumerators work internally. It emphasizes implementation concepts and safe lab testing rather than replacing Nmap, ffuf, or other mature tools.
Prerequisites: Ability to write Python functions, use modules, parse collections, handle exceptions, and read files. Basic knowledge of TCP ports, HTTP status codes, IP/ICMP/TCP headers, and the Linux terminal is expected.
Learning environment: An interactive Ubuntu 22.04 terminal with Python 3, Scapy, requests, local test web servers, and prepared wordlists. Scanning and fuzzing target 127.0.0.1; the packet lab sends a single ICMP Echo Request to 8.8.8.8, subject to network policy.
Frequently Asked Questions
Can I point these tools at any host?
Only scan systems you own or are explicitly authorized to test. The guided scans and final challenge use local services on 127.0.0.1; the Scapy exercise sends one standard ICMP Echo Request to Google Public DNS for packet-response practice.
What if the Scapy probe receives no response?
That is an expected outcome when ICMP or raw packets are blocked. The script includes a two-second timeout and handles a missing reply; the learning goal is packet construction and response logic, not guaranteed Internet reachability.
Are the scanner and directory fuzzer production-ready?
No. They demonstrate core mechanics. Mature tools add bounded concurrency, rate limiting, service detection, retries, wildcard-response handling, TLS options, richer input validation, deterministic output, and extensive testing.
Does “fuzzer” here mean sending malformed payloads?
No. The directory fuzzer performs wordlist-driven path enumeration with ordinary HTTP GET requests and selected status-code filtering. It does not mutate protocol fields, inject application payloads, or test for memory-corruption bugs.
