System administrators and developers need automated, lightweight tools that parse server logs, isolate anomalous behavior, and flag threats instantly—without requiring bloated enterprise SIEM software.

In this guide, we will break down how I built LogSentry, a custom Python security utility that parses authentication logs using regular expressions, tracks failed login attempts via hash-mapped collections, and flags potential brute-force risks right from the command line.

The Technical Architecture

To build a reliable log analyzer from scratch without third-party dependencies, we rely on three core Python modules:

• re: For precise pattern matching to extract timestamps, usernames, and source IP addresses from raw log files.
• collections.defaultdict: For clean, efficient grouping of failed attempt counts per IP address.
• argparse: To build a professional command-line interface (CLI) allowing customizable log paths and threshold parameters.

Step 1: Writing the Regex Parser & Threat Engine (logsentry.py)

The heart of the utility is a regex pattern designed to capture standard authentication log formats (such as SSH auth.log). It scans the file line-by-line to ensure memory efficiency even when processing massive log archives.

import re
from collections import defaultdict
import argparse

def parse_auth_logs(file_path, threshold=3):
    """
    Parses an authentication log file, extracts IP addresses and failed attempts,
    and flags potential brute-force activities exceeding the threshold.
    """
    failure_pattern = re.compile(
        r"([A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2}).*Failed password for (?:invalid user )?(\S+) from (\d{1,3}(?:\.\d{1,3}){3})"
    )
    
    failed_attempts = defaultdict(list)
    total_parsed = 0

    try:
        with open(file_path, "r", encoding="utf-8") as f:
            for line in f:
                total_parsed += 1
                match = failure_pattern.search(line)
                if match:
                    timestamp_str, user, ip_address = match.groups()
                    failed_attempts[ip_address].append({
                        "user": user,
                        "timestamp": timestamp_str
                    })
    except FileNotFoundError:
        print(f"[-] Error: The log file '{file_path}' was not found.")
        return

    print(f"[+] Audit Complete. Parsed {total_parsed} lines.")
    print("-" * 50)
    print(f"{'IP ADDRESS':<18} | {'FAILED COUNT':<12} | {'STATUS'}")
    print("-" * 50)

    for ip, attempts in failed_attempts.items():
        count = len(attempts)
        status = "[!] THREAT DETECTED (Brute-Force Risk)" if count >= threshold else "[i] Normal"
        print(f"{ip:<18} | {count:<12} | {status}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="LogSentry - Local Log Analyzer & Threat Detector")
    parser.add_argument("--logfile", type=str, default="auth_sample.log", help="Path to the log file")
    parser.add_argument("--threshold", type=int, default=2, help="Failed attempt threshold for threat flagging")
    
    args = parser.parse_args()
    parse_auth_logs(args.logfile, threshold=args.threshold)

Step 2: Testing with Mock Log Data

To verify the utility, we can set up a sample log file named auth_sample.log containing simulated authentication entries:

Oct 24 01:10:12 server1 sshd[4120]: Accepted publickey for ubuntu from 10.0.0.5 port 22 ssh2
Oct 24 01:12:05 server1 sshd[4215]: Failed password for root from 192.168.1.50 port 38210
Oct 24 01:12:08 server1 sshd[4217]: Failed password for root from 192.168.1.50 port 38212
Oct 24 01:12:12 server1 sshd[4219]: Failed password for admin from 192.168.1.50 port 38214
Oct 24 01:15:30 server1 sshd[4301]: Accepted publickey for deploy from 10.0.0.8 port 22 ssh2
Oct 24 01:18:44 server1 sshd[4410]: Failed password for invalid user test from 45.33.32.156 port 51220
Oct 24 01:18:46 server1 sshd[4412]: Failed password for invalid user guest from 45.33.32.156 port 51222

When running the script from the terminal with a threshold of 3:

python logsentry.py --logfile auth_sample.log --threshold 3

The terminal outputs a clean, actionable audit report:

[+] Audit Complete. Parsed 7 lines.
--------------------------------------------------
IP ADDRESS         | FAILED COUNT | STATUS
--------------------------------------------------
192.168.1.50       | 3            | [!] THREAT DETECTED (Brute-Force Risk)
45.33.32.156       | 2            | [i] Normal

Key Takeaway

Automating log analysis protects infrastructure against fast-moving automated threats without adding heavy software overhead. Building custom Python utilities gives developers complete control over how logs are parsed, filtered, and alerted.

Check out the full repository on GitHub to view the source code and documentation.

👉 Need a custom Python automation script or security utility built for your infrastructure? Connect with me via my Fiverr Services profile!

#python #cybersecurity #automation #programming #softwareengineering #security

A hash function takes any file (whether it is a 1 KB text file or a 10 GB operating system image) and generates a unique, fixed-length string of characters called a digital fingerprint or checksum.

In this guide, we will build a File Integrity Checker in Python using the built-in hashlib library and demonstrate how SHA-256 instantly detects unauthorized file modifications.

Prerequisites

You do not need to install any third-party packages for this project. Both hashlib and os come pre-installed with Python 3.x.

Step 1: Why Read Files in Chunks?

A common beginner mistake when hashing files in Python is calling file.read() all at once. If you try to hash a 4 GB video file or memory dump that way, Python will attempt to load all 4 GB into your system RAM at once, crashing your script.

Instead, we read the file in 64 KB binary chunks (65536 bytes) and feed each chunk into the SHA-256 algorithm sequentially. This keeps memory usage near zero regardless of file size.

Step 2: Writing the Integrity Checker (file_integrity.py)

Create a file named file_integrity.py and add the following implementation:

import hashlib
import os

def calculate_sha256(filepath):
    """Calculate SHA-256 hash by reading in 64KB chunks."""
    sha256 = hashlib.sha256()
    
    if not os.path.exists(filepath):
        print(f"[-] Error: File '{filepath}' not found.")
        return None

    # Read binary mode in chunks to handle large files safely
    with open(filepath, "rb") as f:
        while chunk := f.read(65536):
            sha256.update(chunk)
            
    return sha256.hexdigest()

def demo_integrity():
    test_file = "confidential_contract.txt"

    # 1. Create a simulated official document
    with open(test_file, "w") as f:
        f.write("Payment terms: Transfer 5,000 USD to Contractor A.")

    # 2. Record its baseline fingerprint (Golden Hash)
    baseline_hash = calculate_sha256(test_file)
    print(f"[*] Document created: '{test_file}'")
    print(f"[*] Original Hash   : {baseline_hash}\n")

    # 3. Simulate an unauthorized modification (Tampering)
    print("[!] Simulating unauthorized edit by an attacker...")
    with open(test_file, "w") as f:
        # Attacker modifies '5,000' to '9,000'
        f.write("Payment terms: Transfer 9,000 USD to Contractor A.")

    # 4. Re-calculate the hash
    current_hash = calculate_sha256(test_file)
    print(f"[*] Current Hash    : {current_hash}\n")

    # 5. Integrity Verification Audit
    print("=" * 20 + " VERIFICATION AUDIT " + "=" * 20)
    if current_hash == baseline_hash:
        print("[+] VERIFIED: The file is authentic and unchanged.")
    else:
        print("[-] TAMPER DETECTED: Hashes do not match!")
        print("[-] The contents have been altered or corrupted.")

if __name__ == "__main__":
    demo_integrity()

Step 3: Running the Verification Audit

Run the script from your terminal:

python file_integrity.py

Terminal Output:

[*] Document created: 'confidential_contract.txt'
[*] Original Hash   : 14e118e3953411eed56a2660dc2aa1d0990fca696d962b946595e6d7a94297fe

[!] Simulating unauthorized edit by an attacker...
[*] Current Hash    : f3f7b6971cb53579d80f0f473baaccd0aeb5e6eba8b83fd9dc718f025b09a4a0

==================== VERIFICATION AUDIT ====================
[-] TAMPER DETECTED: Hashes do not match!
[-] The contents have been altered or corrupted.

Understanding the "Avalanche Effect"

Notice how we only altered a single digit in our text file (changing 5 to 9). Yet the output hash didn't just change by one digit—it mutated from 14e118... to f3f7b6....

In cryptography, this is known as the Avalanche Effect. A microscopic change in the input causes a drastic, unpredictable change in the output hash, making it virtually impossible for an attacker to modify a file while keeping the same SHA-256 signature.

Key Takeaway

File Integrity Monitoring (FIM) is a cornerstone of system security and digital forensics. By recording baseline SHA-256 hashes of critical system configuration files or forensic evidence, you can mathematically prove whether data has remained intact or suffered tampering.

This metadata quietly records device details:

• The camera make and model
• The exact timestamp of when the image was taken
• Camera settings (exposure, focal length, orientation)
• Even GPS coordinates pointing to where the photo was captured

In this quick guide, we will build a lightweight Python script using the Pillow library to inspect and decode hidden EXIF tags from any image.

Prerequisites

You only need:

• Python 3.x installed on your system
• The Pillow imaging library

Install Pillow via your terminal:

pip install pillow

Step 1: Understanding Why We Need TAGS

When you query an image for EXIF data in raw Python, the library returns numeric IDs instead of readable names. For example, the camera model might be stored under tag ID 272, and the timestamp under 306.

To make this human-readable, Pillow provides a dictionary called TAGS that translates these numeric IDs into descriptive strings like "Model" and "DateTime".

Step 2: Writing the Python Extractor

Create a file named extractor.py and add the following code:

import os
from PIL import Image
from PIL.ExifTags import TAGS

def extract_metadata(image_path):
    print(f"[*] Checking image: {image_path}")
    
    if not os.path.exists(image_path):
        print(f"[-] ERROR: File '{image_path}' not found.")
        return

    try:
        # Load the image
        image = Image.open(image_path)
        exif_data = image.getexif()

        # Fallback for images storing tags in legacy EXIF dictionaries
        if not exif_data:
            legacy_getter = getattr(image, '_getexif', None)
            if callable(legacy_getter):
                exif_data = legacy_getter()

        if not exif_data:
            print("[-] No EXIF metadata found in this image.")
            return

        print(f"\n{'='*20} METADATA FOUND {'='*20}\n")
        
        # Loop through raw tags and convert them to readable names
        for tag_id, value in exif_data.items():
            tag_name = TAGS.get(tag_id, tag_id)
            print(f"{tag_name:<25}: {value}")

    except Exception as e:
        print(f"[-] Failed to process image: {e}")

if __name__ == "__main__":
    extract_metadata("test.jpg")

Step 3: Running the Script and Inspecting Output

To test the script, place a camera photograph named test.jpg in your directory and execute:

python extractor.py

Terminal Output:

[*] Checking image: test.jpg

==================== METADATA FOUND ====================

GPSInfo                   : 926
ResolutionUnit            : 2
ExifOffset                : 268
Make                      : NIKON
Model                     : COOLPIX P6000
Software                  : Nikon Transfer 1.1 W
Orientation               : 1
DateTime                  : 2008:11:01 21:15:07
YCbCrPositioning          : 1
XResolution               : 300.0
YResolution               : 300.0

The script reveals that the photo was shot on a NIKON COOLPIX P6000 on November 1, 2008, and also points to embedded GPS data.

Why Did My Personal Photo Show "No EXIF Metadata"?

If you test this script on photos downloaded from WhatsApp, Instagram, or Telegram, you will likely see [-] No EXIF metadata found.

Major social media and messaging platforms intentionally strip EXIF data upon upload to protect user privacy and prevent strangers from extracting home locations or device signatures.

Key Takeaway

Reading image headers is a core fundamental of digital forensics, OSINT investigations, and security audits. In just a few lines of Python, you can audit your own image files and verify whether your personal data is exposed before sharing it online.