Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier to maintain and update?
5
-
"design of the java language that makes writing tools like these simpler". That made me chuckle a little. No. Not simpler. It's probably a sign of that's the language they knew and didn't know better, lol. Do you have a source on "most popular attack proxies"? Such as (not saying it's not, I would just like to know your examples)?– jmqMay 29, 2014 at 23:29
-
I will just say it's all opinion based. Java is more restrictive for it's privileges so it might not be as good as other language. However for web attacks, it will be more suitable as it has readily available supported classes so it's actually simpler to write the codes than in other languages, though it's all opinioned based on what the attacker wants to do and if Java can do it. And where is the evidence / research that Java is the most popular attack proxies? I wondered where you get the data from.– SkyMay 30, 2014 at 1:08
-
I think the OP is referring to Burp, ZAP, DirBuster etc that is written in Java. I think it has to do more with the cross platform nature of Java and the fact that the application could be exported as a single jar.– void_inMay 30, 2014 at 6:44
-
void_in is correct, by "most popular" i'm referring to Burp, ZAP and (not so much now i guess) WebScarab. I also agree that this is potentially too broad a question and very open to opinion, i was in two minds about asking it but curiosity got the better of me. I'm happy for it to be closed as opinion based if the general consensus is that the decision to code a product in a certain language is more a design choice than a security choice.– AlexHMay 30, 2014 at 10:49
-
Further more, in the context of the original question, my saying "specifically" is inaccurate. I should of said "the example which comes to mind first and foremost". But then that changes the question from being about the specific design choices of security tools, to the design choices of a more general programming nature (stackoverflow maybe?). Regardless i'm now pretty convinced this isn't a productive topic.– AlexHMay 30, 2014 at 10:53
Add a comment
|
1 Answer
Reason for high level languages: Let's say you are writing a program that is written that executes under the attackers machine which may send an attack against a remote machine or whatever. There is no point writing in in low level language is it requires more time to manage. So, you may as well write it in high-level language which uses bytecode language such as .NET or Java etc so it's cross-platform and easy to manage and scalability.
Reason for low level languages or native code: Let's say you are writing some form of pentest code to execute under the victims machine you ideally want less dependencies so it will likely to execute under more machines. If we used high-level language such as Java then we need all victims to have Java VM installed.
If we are talking about Windows platform then other reasons for native code would be exploiting internal windows is much harder to do under bytecode languages. Bytecode only executes under ring 3 where as native languages such as assembly, C and C++ you can write drivers to execute at lower rings.
So, summary just depends on what your coding.
