Automated Security Auditing - Rishan Solutions

Security auditing is essential for identifying vulnerabilities, enforcing security policies, and ensuring compliance with security standards. Python provides powerful automation capabilities for security auditing, helping cybersecurity professionals conduct regular and efficient security assessments.

What You’ll Learn

✔ Understanding automated security auditing
✔ Setting up a security auditing environment
✔ Performing network and system audits
✔ Detecting vulnerabilities in web applications
✔ Log analysis for security monitoring
✔ Automating compliance checks

🔹 1. Setting Up an Automated Security Auditing Environment

Before starting, install the required Python libraries:

pip install nmap python-whois requests beautifulsoup4 shodan paramiko

Essential Tools & Libraries

Nmap (python-nmap) – Network scanning
Shodan API – Internet-wide scanning
Scapy – Packet analysis
Paramiko – SSH security auditing
Requests & BeautifulSoup – Web vulnerability scanning
OS & Logging Modules – System log analysis

2. Network Security Auditing

Network auditing identifies open ports, running services, and potential misconfigurations.

Scanning Open Ports with Nmap

import nmap

scanner = nmap.PortScanner()
scanner.scan("192.168.1.1", "22-443")

for host in scanner.all_hosts():
    print(f"Host: {host} ({scanner[host].hostname()})")
    print(f"State: {scanner[host].state()}")
    for proto in scanner[host].all_protocols():
        print(f"Protocol: {proto}")
        for port in scanner[host][proto]:
            print(f"Port: {port} - State: {scanner[host][proto][port]['state']}")

Finds open ports that could be exploited.

3. Web Application Security Auditing

Web applications are common attack targets. Python can automate testing for vulnerabilities.

Detecting SQL Injection Vulnerabilities

import requests

url = "http://example.com/login.php"
payload = {"username": "admin' OR '1'='1", "password": "password"}

response = requests.post(url, data=payload)

if "Welcome" in response.text:
    print("Potential SQL Injection vulnerability detected!")

Identifies weak authentication and SQL injection risks.

Detecting XSS (Cross-Site Scripting) Vulnerabilities

xss_payload = "<script>alert('XSS')</script>"
xss_test_url = f"http://example.com/search?q={xss_payload}"

response = requests.get(xss_test_url)

if xss_payload in response.text:
    print("Potential XSS vulnerability detected!")

Detects reflected XSS vulnerabilities.

4. SSH Security Auditing

Weak SSH configurations can lead to unauthorized access.

Checking for Weak SSH Passwords

import paramiko

def check_ssh_password(ip, username, password):
    try:
        client = paramiko.SSHClient()
        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        client.connect(ip, username=username, password=password, timeout=5)
        print(f"Weak credentials found: {username}:{password}")
        client.close()
    except:
        print("No weak credentials found.")

check_ssh_password("192.168.1.1", "admin", "admin123")

Detects weak SSH credentials that attackers might exploit.

5. Log File Analysis for Security Auditing

Log files provide insights into unauthorized access attempts and anomalies.

Detecting Failed Login Attempts in Linux Authentication Logs

log_file = "/var/log/auth.log"

with open(log_file, "r") as f:
    for line in f:
        if "Failed password" in line:
            print(line.strip())  # Potential brute-force attack

Finds brute-force attacks on SSH or system logins.

6. Automated Compliance Auditing

Security compliance ensures adherence to industry standards like ISO 27001, NIST, CIS Benchmarks, etc.

Checking File Permissions for Security Compliance

import os

def check_permissions(file_path):
    permissions = oct(os.stat(file_path).st_mode)[-3:]
    if permissions != "600":
        print(f"Warning: {file_path} has insecure permissions ({permissions})")

check_permissions("/etc/shadow")

Identifies files with weak permissions that could be exploited.

7. Automating Security Audits with Python

Regular security audits should be automated to ensure consistency and efficiency.

Automating a Periodic Security Audit

import subprocess

def run_security_audit():
    print("Starting security audit...")

    # Check open ports
    subprocess.run(["nmap", "-sS", "192.168.1.1"])

    # Check system logs
    subprocess.run(["grep", "Failed", "/var/log/auth.log"])

    # Check weak SSH passwords
    check_ssh_password("192.168.1.1", "admin", "admin123")

    print("Security audit completed.")

run_security_audit()

Runs multiple security checks automatically.