File Handling

open(path, mode, encoding=...) returns a file object. Mode "r" reads (file must exist). "w" writes, creating the file or truncating it to empty — that is a destroy-and-replace, not an append. "a" appends. "x" fails if the file exists (useful when you do not want to clobber). Text mode is the default; binary "rb"/"wb" is for hashes of raw bytes (Lesson 1 used Path.read_bytes()). If you write f = open(...) and then return or raise, the handle can leak until the process ends. with open(...) as f: enters a context: the block runs, then f.close() is called on the way out, exception or not. That is the mechanism. It is not slower in any way you should care about. It is how scripts survive a mid-loop UnicodeError without leaving a lock on Windows.

Iterate with for line in f: so you stream. f.read() slurps the whole file; fine for a 20-line lab log, painful and memory-heavy for a multi-gigabyte export. line still includes the newline; line.strip() is the usual hunt form. "needle in line" is a substring check — the DNA of the next lab — not a regex yet (regex is a later module). Write with out.write(item + " ") or print(item, file=out). Always pass encoding="utf-8" for lab text so Windows and Unix agree. errors="ignore" or "replace" is a conscious choice for messy logs; silent ignore can hide the line you needed. In this course, prefer utf-8 and fix the sample file you authored if it is broken.

Path.home() / "cyberlium-lab" / "practice.log" builds a path object. / here is Path’s join operator, not a root you are escaping to. str(path) if an API wants a string. path.write_text(...) and path.read_text(encoding=) are short forms that still need an encoding. path.open("r", encoding="utf-8") works inside with. The security habit is a root variable: lab = Path.home() / "cyberlium-lab"; then only lab / filename. If you later take a filename from a user, a real tool must reject .. and absolute paths so "wordlist" cannot become /etc/shadow (path traversal). This beginner course does not take untrusted pathnames. You hardcode the lab root. That is a feature.

Never Path("/etc/shadow"), Path("/etc/passwd"), or a classmate’s absolute Downloads path “because the log is there.” Never open a file over a share you do not own. If mkdir fails, create $HOME/cyberlium-lab yourself; do not fall back to C:\ or /. Relative open("auth.log") depends on the current working directory — a classic “it worked in my IDE” bug that reads a different file when you run from another folder. Prefer Path.home() so the location does not depend on pwd. Then chmod 600 files that might hold findings, even fictional ones, so a shared account on the same PC is not your SIEM.

Security tutorials love “wordlists”: one string per line. In attack culture that file is a password dictionary aimed at a login. In this course a wordlist is data you wrote — needles, usernames from a fictional lab, sample status tokens — so you can practice for line in f and membership tests. Creating rockyou.txt clones to spray at a website is not File Handling homework. Reading a wordlist you authored into a list, writing a filtered copy, and chmod 600 the result is File Handling homework. If a blog says otherwise, it is not this syllabus. The file extension does not change the ethics: .txt in cyberlium-lab is yours; a dump from a breach is not a lab asset.

Text in Python 3 is str (Unicode). Bytes on disk need a codec. utf-8 is the lab default. Some Windows logs are utf-16; some appliances emit latin-1. If you omit encoding, the default can differ by platform and your script becomes a lottery. UnicodeDecodeError is a gift: it tells you the contract failed. Swallowing it with a bare except is how you skip the line that had the attacker’s IP as mojibake. For files you create, write utf-8 and read utf-8. For a future export you are allowed to have, document the encoding in the JSON note beside it. Binary hashing stays on bytes (Lesson 1). Do not hash a decoded str and think it matches another tool’s file digest.

Create practice.log with a few fictional lines you type. Read with a context manager. Write hits.txt with only the lines that contain a needle you chose (for example Failed password). That is the entire next lab, minus the story dressing. Keep both files in the lab directory. chmod 600. Do not copy a real production log from work into the folder — work logs can hold customer data you are not allowed to take home.

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"

cat > file_lab.py << 'EOF'
from pathlib import Path

lab = Path.home() / "cyberlium-lab"
lab.mkdir(parents=True, exist_ok=True)

log_path = lab / "practice.log"
report_path = lab / "hits.txt"
wordlist_path = lab / "sample_needles.txt"

# Files we authored. Not /etc/shadow. Not a breach dump.
log_path.write_text(
    "sshd: Failed password for root from 10.0.0.5 port 51234 (FICTIONAL)
"
    "sshd: Accepted password for alice from 10.0.0.9 port 51111 (FICTIONAL)
"
    "sshd: Failed password for admin from 10.0.0.5 port 51235 (FICTIONAL)
",
    encoding="utf-8",
)
wordlist_path.write_text("Failed password
Accepted password
", encoding="utf-8")

needle = "Failed password"
hits = []
with log_path.open("r", encoding="utf-8") as f:
    for line in f:
        if needle in line:
            hits.append(line.strip())

with report_path.open("w", encoding="utf-8") as out:
    for item in hits:
        out.write(item + "
")

print(f"wrote {len(hits)} hit(s) to {report_path}")
# NEVER: Path("/etc/shadow").read_text()
# NEVER: use sample_needles.txt against a live login
EOF

python file_lab.py || python3 file_lab.py
chmod 600 "$HOME/cyberlium-lab/practice.log" \
          "$HOME/cyberlium-lab/hits.txt" \
          "$HOME/cyberlium-lab/sample_needles.txt" \
          "$HOME/cyberlium-lab/file_lab.py"

You can stream lines with a context manager, join paths with pathlib from a lab root, declare utf-8, and refuse system secret files and other people’s data. A wordlist is practice text you wrote. Next — Lab — First Python Script — you will create a fictional sample_auth.log, chmod 600 it, and print every line that contains Failed password: the same mechanism, now as a hunter you run on purpose.