Which languages are better for writing tools for attacking websites, through, say, a DDOS? High level, low level, and does it even make a difference?

  • 1
    Which attacks do you mean - network tools, exploits, parsers/bots, or you mean scanners writing, something else? You should precise.
    – anonymous
    Commented Nov 21, 2010 at 0:47

3 Answers 3


Hmm, I would have to say Python, Bash and/or Perl. Why? Well they are installed by default on most of *NIX platforms (most of the web servers) and are easy to program for a quick hack (again I'm talking hacking code).

DISCLAIMER: I am not promoting penetration attacks :D

  • nor am I. :-)
    – Moshe
    Commented Nov 21, 2010 at 0:53
  • Oh I know, I just don't want people fighting over this for no reason Commented Nov 21, 2010 at 0:53
  • Why is Python and Perl installed by default?
    – Pacerier
    Commented Mar 28, 2015 at 17:23

It depends on what you are trying to do and what you are comfortable with. Any modern language has what you need to carry out attacks against web sites.

High level dynamic languages (e.g. python, ruby) can make working with different protocols fairly easy and have plenty of packages that also make it very easy to parse different data without having to code a lot of it yourself.

I've been moving a lot of my development to python (as much as I can). I still use C,C++ for systems level stuff but I think that is a bit too low level for how I am interpreting your question.

I would also say that learning Javascript and SQL is definitely something that you would want to understand as well.


Web development frameworks are not equal, but app developers usually make mistakes even in the most secured ones.

Managed code (high-level is a misnomer on your part) is preferred for a large variety of reasons. Since managed code relies on a VM and usually compiles to bytecode, it is uncomplicated to reverse engineer, or even decompile, to literal source code. This full knowledge approach will certainly aid penetration-testing, but secure static code analysis often requires buildable source (which almost always requires all development artifacts, especially the VM/runtime, base class libraries (BCL), and external components).

The VMs in various managed code languages may also be hardened. Some external components contain a "map" of missing features not available in the BCL. In unmanaged code (what you refer to as lower-level languages, such as C/C++/Assembler), the compiler/assembler could be hardened in a similar way as the VM, but this is an arduous task in comparison without centralization of exception handling. In this case, banned-function lists are often prescribed. Typical examples of secure external components are OWASP ESAPI for managed and Coverity Extend for unmanaged.

  • I think (but I'm not sure since the question is agreeably a bit unclear) that @Moshe meant which languages to use to perform the PT, e.g. write exploits/tests/etc.
    – AviD
    Commented Nov 21, 2010 at 11:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .