Python#
Python is the operator’s easiest-to-learn and most versatile language. Dynamically typed, interpreted, multi-paradigm, with a deep standard library and the largest third-party ecosystem of any modern language. Recon scripts, exploit prototypes, parsers, scrapers, RAG plumbing, MCP servers, agent loops, and analysis notebooks all live here.
Python is fast enough for everything it does at scripting and prototyping scale, and slow enough that long-running services with hard latency requirements need a different language. When CPU matters, drop into C or Rust at the hot spot and stay in Python everywhere else. Python 3.13’s optional free-threaded build (PEP 703) closes part of the gap for CPU-bound threaded work without leaving the language.
Prefer the standard library. On a target the operator may not get
to pick their dependencies; what ships with Python ships with
Python. urllib, argparse, json, tomllib,
sqlite3, subprocess, pathlib, re, and hashlib
cover most of what the operator needs without a single
pip install.
Baseline. Python 3.12+ is the baseline assumed here; recipes
use modern syntax (match patterns, PEP 695 generic def
f[T](xs: list[T]) syntax, | union types, pathlib.Path,
f"{x=}" self-debug, tomllib) without apology. Where a
recipe needs 3.13 (free-threading, sub-interpreters) it is
called out inline.
Default tooling. uv for project / venv / lock-file /
multi-Python management; ruff for formatting + linting;
mypy or pyright for type checking; pytest plus
hypothesis for tests. pip and poetry still work and
the operator meets them on inherited projects, but new work
starts with uv.
Setup#
Picking the right Python and getting the toolchain on the host.
uv, pyenv, python -m venv, activate,
pip. Picking the right Python on the host and
bootstrapping a project.
uv, pip, poetry, ruff, mypy,
pyright, pytest, black, bandit. The
modern toolchain around the interpreter.
pyproject.toml, build backends, wheel and sdist,
twine, PyPI, internal indexes, trusted publishing.
logging, handlers, formatters, dictConfig,
structured JSON, context binding, structlog.
One-liners and code pieces: files, text, data, time, network. Copy-paste ready.
Language#
The spec building blocks in the order every language page on this handbook follows.
#, """, \, indentation, True False None.
Comments, identifiers, keywords, literals, statements
versus expressions.
=, :=, del, global, nonlocal. Names,
binding, LEGB scope, lifetime.
int float bool str bytes list dict set tuple None,
isinstance, type. Primitives, composites, boolean,
casting, type hints.
+ - * / // % **, == != < >, and or not,
is in, & | ^ ~ << >>, :=. Arithmetic,
boolean, bitwise, identity, walrus, precedence.
if elif else, for while, match case,
break continue return pass. Branching, loops, pattern
matching, jumps.
def, lambda, return, yield,
async def, await, @decorator. Parameters,
closures, generators, comprehensions.
class, self, super, @property,
@staticmethod, @classmethod, @dataclass,
dunder methods. Classes, inheritance, MRO, protocols,
operator overloading.
Patterns#
The layer above the spec. The dialect a Python program written by an operator should be written in.
EAFP, with context managers, comprehensions,
unpacking, @dataclass, @cache, @contextmanager.
Pythonic style and design patterns.
try except else finally, raise, raise ... from,
assert, exception groups, BaseException vs
Exception, traceback handling.
Data Structures#
The containers and algorithms the standard library hands the operator.
list dict set tuple frozenset, deque Counter
defaultdict OrderedDict namedtuple ChainMap,
heapq. Built-in containers and collections.
sorted, bisect, heapq, itertools,
functools, operator. The standard-library
algorithm catalog.
I/O#
Talking to files, the network, the shell, and the OS scheduler.
open, pathlib.Path, sys.stdin/stdout/stderr,
print, input, json csv tomllib struct base64.
Files, streams, formatting, parsing.
argparse, click, typer, sys.argv,
sys.exit, exit codes, stdin / stdout streaming.
Sockets: socket / ssl. HTTP: urllib,
requests, httpx, aiohttp. WS:
websockets. DNS: dnspython. SSH:
paramiko.
Threads: threading. Processes:
multiprocessing. Async: asyncio,
async / await. Pools:
concurrent.futures. The GIL.
Runtime#
Memory, the interpreter, and the import system between the operator’s source and the machine.
import, from / as, sys.path,
sys.modules, gc, dis, __pycache__,
pyproject.toml, CPython / PyPy / MicroPython, the
GIL.
Ecosystem#
The standard library, PyPI, and the third-party frameworks the operator pulls in when prototype time runs out.
Stdlib: filesystem, data formats, text, dates, collections, concurrency, networking, crypto, persistence, observability. PyPI: HTTP, CLI, data, logging, resilience, testing, OSINT.
Web: fastapi, django, flask.
Scraping: scrapy. Tasks: celery.
Data: numpy / pandas / polars /
jupyter. ML: pytorch.
Practice#
The disciplines that make scripts safe to ship and the end-to-end projects that exercise the whole stack.
pytest, hypothesis, coverage,
@fixture, @parametrize, mock, assert.
Fixtures, parametrize, mocking, property-based testing.
End-to-end projects that pull the chapters together; a news ingester, a Shodan client, an MCP server, a static site generator.