Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently I came across a site called SecurityTube.net, which has a ton of amazing security stuff. I'm following their Python Scripting Expert videos which are totally worth it. I also came across the concept of 'Crypters', which evade antiviruses and can be used for Metasploit payloads.

I decided to ask here because there's a lot of varying opinions like:

  1. Python isn't the best language to write a Crypter, as the exe generated is large.
  2. VB is the real deal, etc.

I personally feel the best roadmap starts with diving deep into the assembly language videos posted on SecurityTube and graduate to at least the Exploit Research series.

I've some experience with Java (along with some JCE) and PHP i.e. general high level programming being an IT student but low level programming has only recently interested me.

So is my thinking of diving into assembly in parallel with my Python learning the correct pathway?
Thanks

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

If you want to write a crypter, usually you take a certain shellcode and then load it into a script which generates another shellcode which contains an encrypted form of your shellcode. At runtime the shellcode will then be decrypted and run. To generate this encrypted form you will need to either use an existing crypter or create your own. In your python script you then encrypt your shellcode so it's decryptable from your new shellcode (which contains the encrypted shellcode).

I'm an avid Python user, others here use Ruby (in which Metasploit is written btw). In the end you should use the best tool for the job. However this is very diverse depending on your platform. So you should just try a few tools and then decide which is best for you. There is not a single good tool for doing this. (but you will need to learn some assembly if you want to write low level exploits)

share|improve this answer
    
Thanks for your reply Lucas. A is the shellcode, B is the script, then A + B = C(encrypted shellcode) which will be decrypted at runtime. So either I can use A (an existing shellcode or write one from scratch) and then add it to B(my custom Python script) to generate C. I hope I got it right. –  SidNoob Jun 25 '13 at 6:11
    
Exactly, you should have a look at my blog ( click my name) I did the security tube Linux assembly expert which actually details most of this. It's pretty neat :) –  Lucas Kauffman Jun 25 '13 at 7:53
    
I had some confusion at first. But later on, I saw your Linux Assembly assignment and I got exactly what you meant!! I came back to reply you, but stackexchange was saying 'comment edits allowed only every 5 minutes'. So I left :) –  SidNoob Jun 25 '13 at 8:48
1  
If this was useful for you, you can always accept it by clicking the accept mark :) –  Lucas Kauffman Jun 25 '13 at 21:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.