Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Which languages are better for writing tools for attacking websites, through, say, a DDOS? High level, low level, and does it even make a difference?

share|improve this question
1  
Which attacks do you mean - network tools, exploits, parsers/bots, or you mean scanners writing, something else? You should precise. –  anonymous Nov 21 '10 at 0:47

3 Answers 3

up vote 2 down vote accepted

Hmm, I would have to say Python, Bash and/or Perl. Why? Well they are installed by default on most of *NIX platforms (most of the web servers) and are easy to program for a quick hack (again I'm talking hacking code).

DISCLAIMER: I am not promoting penetration attacks :D

share|improve this answer
    
nor am I. :-) –  Moshe Nov 21 '10 at 0:53
    
Oh I know, I just don't want people fighting over this for no reason –  Georges Nov 21 '10 at 0:53

It depends on what you are trying to do and what you are comfortable with. Any modern language has what you need to carry out attacks against web sites.

High level dynamic languages (e.g. python, ruby) can make working with different protocols fairly easy and have plenty of packages that also make it very easy to parse different data without having to code a lot of it yourself.

I've been moving a lot of my development to python (as much as I can). I still use C,C++ for systems level stuff but I think that is a bit too low level for how I am interpreting your question.

I would also say that learning Javascript and SQL is definitely something that you would want to understand as well.

share|improve this answer

Web development frameworks are not equal, but app developers usually make mistakes even in the most secured ones.

Managed code (high-level is a misnomer on your part) is preferred for a large variety of reasons. Since managed code relies on a VM and usually compiles to bytecode, it is uncomplicated to reverse engineer, or even decompile, to literal source code. This full knowledge approach will certainly aid penetration-testing, but secure static code analysis often requires buildable source (which almost always requires all development artifacts, especially the VM/runtime, base class libraries (BCL), and external components).

The VMs in various managed code languages may also be hardened. Some external components contain a "map" of missing features not available in the BCL. In unmanaged code (what you refer to as lower-level languages, such as C/C++/Assembler), the compiler/assembler could be hardened in a similar way as the VM, but this is an arduous task in comparison without centralization of exception handling. In this case, banned-function lists are often prescribed. Typical examples of secure external components are OWASP ESAPI for managed and Coverity Extend for unmanaged.

share|improve this answer
    
I think (but I'm not sure since the question is agreeably a bit unclear) that @Moshe meant which languages to use to perform the PT, e.g. write exploits/tests/etc. –  AviD Nov 21 '10 at 11:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.