2

I recently graduated and now work as a software developer but at some point in my career, I would like to transition into Penetration Testing.

I know that pen testers sometimes write their own tools but I am curious to know if they follow and use Design Patterns, SOLID principles and aim to write clean code, or is it more about getting the program to do its task.

closed as primarily opinion-based by Xander, John Deters, S.L. Barth, Matthew, Dog eat cat world Nov 9 '16 at 11:29

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Welcome to the security stack exchange! This kind of question, while interesting, invites a lot of opinion, and is generally not the sort of question that stays open or receives a lot of attention. Everyone is different! Some, I'm sure, follow best practices and principles, others just wish to get the job done, and others might barely recognize a chunk of assembly if you beat them over the head with it. If possible, try to narrow the question down into something specific, and not too debatable. – INV3NT3D Nov 7 '16 at 20:59
  • 10
    IMO most pentesting tools I have seen aren't scalable, are poorly coded or even include vulnerabilities. That being said, pentesting tools are different than normal applications. A pentesting tool is (Usually) an ad-hoc program, that is made with a specific goal in mind, which is testing/exploiting a vulnerability. You can't spend a lot of time to develop a test/exploit for a vulnerability if it's going to be patched by the time you finish it, right? Of course I'm not talking about frameworks (Like metasploit or nmap) that are prepared to scale and use the previously mentioned scripts – Mr. E Nov 7 '16 at 20:59
  • Anyway, I think this question is not security related, so I'm going to vote to close it as it's opinion based – Mr. E Nov 7 '16 at 21:00
  • 8
    Actually, I'd ask if all programmers use Design Patterns, SOLID, and aim to write clean code. You might find a comparable precent of pen testers as programmers .... – schroeder Nov 7 '16 at 21:29
11

There's a big distinction between pen testers who write a bit of code, and developers of security tools.

During a pen test, you may need to write some custom code. For example, if you find server-side template injection, there's likely to be no off-the-shelf exploit that works in this exact scenario. But with a little bit of coding you can get a shell. These scripts just get the job done; design patterns are irrelevant.

Many security tools are much more complex than one-off scripts. Metasploit is a good example. Before Metasploit, most exploits were developed like one-shot pen test scripts. The exploit would target a specific vulnerability and deliver a specific payload. Metasploit introduced modularity and structure into exploit development. In particular, separating the concepts of: exploits, payloads, and encoders.

In fact, there are now all sorts of security tools that are developed with strong design practices in mind, although a lot of these are commercial, e.g. Nessus, Checkmarx, Burp Suite.

3

For pentesting work, you will likely use plenty of various libraries and I think it's the main aspect of the job.

Knowing this, it's also a bit of work to organize these projects, have all libraries on your system and so on. One project / folder per each utility you create is pretty a lot of job.

For pentesting utilities you do not need a lot of design patterns or stuff like that. You might need something like workflow engine to run your utilities, just like metasploit does.

I'd recommend to use one of the existing workflow engines and try to write utilities / plugins only. This way you can achieve a lot without getting into high waters.

Another bit is to decide on your programming language so you can stick to just one for most of the time. Reading from your question, that could be Python, Ruby, Java, C# etc which are all great for scripting purposes.

  • 1
    Java and C# are great for Scripting? – pguetschow Nov 8 '16 at 8:11
  • Yes, they are, I am doing plenty of various utilities in both and they are really great for scripting as there isn't any viable alternative. In Java you can use Groovy for example to make it even more simple. Note that startup time, exception handling, available libraries, IDEs, downloadable examples really matter when you have diverse problems. The difference between programs and scripts is very weak. You can't tell the difference whatever python is script or something else, same for Java and C#. – Aria Nov 8 '16 at 8:15
  • Intesresting, I thought they were rarely used – pguetschow Nov 8 '16 at 8:20
  • I would say, rather, than someone who knows C# would do very well to use PowerShell for scripting. It's a learning curve, but the libraries are all there for you to use. And a REPL. – sq33G Nov 8 '16 at 9:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.