Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Sharpening Python Tools with Rust

TheTechromancer

ReconTalks29 minIntermediateOpen on YouTube ↗

Where

Talks
CactusCon 14

Duration

29 min

Shows how selected Rust components can speed up a Python security tool through PyO3, with benchmarks and packaging steps.

Summary

The talk starts from a familiar tension: Python is quick to develop in but slow for high-volume DNS and web work. The presenter, lead developer at Black Lantern Security, uses BBOT, a recursive OSINT tool he created, as the case study. Large enterprise scans could run for a week, so throughput mattered in practice, not just in theory.

Benchmarks came first. Simple programs in C, Go, Rust and Python each used twenty workers to resolve DNS queries and fetch web pages. Against a local DNS server, C handled roughly 83,000 lookups per second while pure Python managed about 4,500, and web requests showed a similar gap. Rust tracked close to Go and C. The core technique is PyO3, which talks to the Python C API directly instead of going through a C-based interface, so Rust functions and classes appear as ordinary Python modules. Maturin compiles the extension during installation, and GitHub Actions can produce precompiled wheels across Python versions and CPU architectures. A Rust-backed DNS prototype, BlastDNS, ran more than ten times faster than pure Python.

Practical lessons followed. Crossing the Python boundary carries overhead because of the global interpreter lock, so batching queries reduced it substantially. Replacing BBOT's bottlenecks one component at a time kept the Python core intact and made outside contributions easier. An SSL build pitfall also came up, and tests and benchmarks were recommended, especially when AI helps write unfamiliar Rust.

Related talks

Talks·44 min

  • Disobey
  • Community
  • Date: Feb 2024
  • Location: Finland

Joona Hoikkala

Walks through maintaining the ffuf web fuzzer, from community growth and feature requests to rejecting pull requests.

open-sourcelessons-learnedtool+2