1

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier to maintain and update?

  • "design of the java language that makes writing tools like these simpler". That made me chuckle a little. No. Not simpler. It's probably a sign of that's the language they knew and didn't know better, lol. Do you have a source on "most popular attack proxies"? Such as (not saying it's not, I would just like to know your examples)? – jmq May 29 '14 at 23:29
  • I will just say it's all opinion based. Java is more restrictive for it's privileges so it might not be as good as other language. However for web attacks, it will be more suitable as it has readily available supported classes so it's actually simpler to write the codes than in other languages, though it's all opinioned based on what the attacker wants to do and if Java can do it. And where is the evidence / research that Java is the most popular attack proxies? I wondered where you get the data from. – Sky May 30 '14 at 1:08
  • I think the OP is referring to Burp, ZAP, DirBuster etc that is written in Java. I think it has to do more with the cross platform nature of Java and the fact that the application could be exported as a single jar. – void_in May 30 '14 at 6:44
  • void_in is correct, by "most popular" i'm referring to Burp, ZAP and (not so much now i guess) WebScarab. I also agree that this is potentially too broad a question and very open to opinion, i was in two minds about asking it but curiosity got the better of me. I'm happy for it to be closed as opinion based if the general consensus is that the decision to code a product in a certain language is more a design choice than a security choice. – AlexH May 30 '14 at 10:49
  • Further more, in the context of the original question, my saying "specifically" is inaccurate. I should of said "the example which comes to mind first and foremost". But then that changes the question from being about the specific design choices of security tools, to the design choices of a more general programming nature (stackoverflow maybe?). Regardless i'm now pretty convinced this isn't a productive topic. – AlexH May 30 '14 at 10:53
1

Reason for high level languages: Let's say you are writing a program that is written that executes under the attackers machine which may send an attack against a remote machine or whatever. There is no point writing in in low level language is it requires more time to manage. So, you may as well write it in high-level language which uses bytecode language such as .NET or Java etc so it's cross-platform and easy to manage and scalability.

Reason for low level languages or native code: Let's say you are writing some form of pentest code to execute under the victims machine you ideally want less dependencies so it will likely to execute under more machines. If we used high-level language such as Java then we need all victims to have Java VM installed.

If we are talking about Windows platform then other reasons for native code would be exploiting internal windows is much harder to do under bytecode languages. Bytecode only executes under ring 3 where as native languages such as assembly, C and C++ you can write drivers to execute at lower rings.

So, summary just depends on what your coding.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.