My question is: What is it that makes those languages suitable? From what I know, they are slower than other languages, and operate at a higher abstraction level, which means they are too far from the hardware. The only reason I could think is because of their advanced string manipulation capabilities, but I believe that other languages have such capabilities.
Languages are useful for doing things. What type of things it's suitable for completely depends on the type of language, the frameworks available for it, what OSes have interpreters / compilers for it, etc.
Let's look at the ones you've mentioned:
So what makes these particularly good for pentesting? Well, most pentesting involves writing up quick throw-away tools to do a specific job for a specific test. Writing such a tool in C or C++ every time you want to do a quick job is cumbersome and time-consuming. Furthermore, they tend to produce platform-specific binaries or source that requires platform-specific compilation, rather than cross-platform scripts that just run. Scripting languages give you the flexibility to produce such tools quickly and easily.
Now, the other side of the coin is languages used as payloads. This is where the line gets blurred, because requirements are so varied. For attacking Windows boxes, any payload that has no dependencies outside of what the OS provides is useful. This might be C, C++, VBScript, x86 asm, C# / VB.NET (.NET 2.0 is on most machines these days), etc. For attacking Linux boxes you might use C, C++, bash scripts or Perl. Java is also common for cross-platform attacks.
At the end of the day, pick the language that you find best for the job!
My two cents:
The quickness of the language doesn't matter when you are in full brainstorm!
One of the most usefull and powerfull language for this kind of operation seem to be forgotten in your question.
Under Un*x, you're primarily logged in a shell console, to be able to run other tools.
If it is one of the slower language:
Yes! More than 4 seconds for a 1 million step loop is very slow, but once you're logged in a command line console...
you could start from:
From there, you may use all tool you want, like
If you're interested about SSL, or...
You may benefit of a full environment for storing variables
Depending on what you're searching for, you could use widely all your tool in all combination.
This could by re-written:
Mini script from there:
With this, you will make two ping, parallelized (this will normaly take only 1 seconds) on ~5 hosts:
Other (more efficient) languages
Once the goal is fixed, after a lot of brainf@#@ing, common hacker will run his prefered editor and store his exploit as a script to automate next run.
The choice of the language used will depend mainly on the hacker's preferences. (If not required by his boss.)
I don't see any mumbo jumbo here. In fact this is not that much longer than a full python program to do the same. Some loops are shorter in C than they could ever be with python, especially when in C you can use pointers which considerably give much more power and shorten the code to between 10 and 70 percent of the python equivalent. Of course normally C code is longer cause thats just the nature of more powerful languages.
Anyway hacking is done in C the best. forget anything else just go C.
Here is a great answer I found on a stack overflow question of similar context by @tqbf: (I copied this answer here, because I believe it gives valid reasons for which they may be prefered, so it might be useful to future readers)
Libraries, Time to write Code, cross-platform compatibility are key here. I found that using Python I was able to come up with Proof-of-concept exploits in a very short amount of time with minimum lines of code. This is possible because of the extensive standard library and additional libraries that you can download as well. I believe that is python's greatest strength to be used for pentesting and hacking.
Ex. you need a string of 1000 characters / 1000 bytes long.
In C :
(Apart from all the includes mumbo jumbo and compiling it)
That is just a simple example. But as you can see the time taken for such a trivial task is far simpler in python.
The difference can be even more enhanced when you want to send http requests etc from your code. With
Some good answers already to this one but I'll provide another perspective. One reason that scripting languages tend to be used for hacking is that they optimize for speed (and ease) of development which is likely to be a key factor.
As an example, for penetration testing scripting I use ruby. It has a number of good libraries for things like HTTP which mean I don't have to worry about low level details and writing a quick script is very fast as there's little "formality" required in a ruby script (e.g. method/variable declarations) when compared with languages like Java.
One of the downsides of these languages can be that they are slower at run-time, but for a lot of hacking work that's not an issue, speed of development is more important.
I think what defines a language suited for hacking, is:
Take an example of Java. It runs on all platforms, and is installed on a lot of system. This ensures a fairly high probability that the hackers code can run, and the language is installed on the system he targets.
The community of given highly used programming language, also occasionally finds vulnerabilities in the language, which allowed hackers to target that vulnerability, and have a very high change of hitting it, due to the high distribution of the language.
I have zero knowledge in these fields, but the mentioned programming languages all enable rapid programming, i.e. one could try out a much larger number of different ideas in a given time frame than with the more runtime-efficient but inefficient for programming (and debugging) programming languages like C etc. That might be a point.