Which languages are better for writing tools for attacking websites, through, say, a DDOS? High level, low level, and does it even make a difference?

  • 1
    Which attacks do you mean - network tools, exploits, parsers/bots, or you mean scanners writing, something else? You should precise.
    – anonymous
    Nov 21 '10 at 0:47

Hmm, I would have to say Python, Bash and/or Perl. Why? Well they are installed by default on most of *NIX platforms (most of the web servers) and are easy to program for a quick hack (again I'm talking hacking code).

DISCLAIMER: I am not promoting penetration attacks :D

  • nor am I. :-)
    – Moshe
    Nov 21 '10 at 0:53
  • Oh I know, I just don't want people fighting over this for no reason Nov 21 '10 at 0:53
  • Why is Python and Perl installed by default?
    – Pacerier
    Mar 28 '15 at 17:23

It depends on what you are trying to do and what you are comfortable with. Any modern language has what you need to carry out attacks against web sites.

High level dynamic languages (e.g. python, ruby) can make working with different protocols fairly easy and have plenty of packages that also make it very easy to parse different data without having to code a lot of it yourself.

I've been moving a lot of my development to python (as much as I can). I still use C,C++ for systems level stuff but I think that is a bit too low level for how I am interpreting your question.

I would also say that learning Javascript and SQL is definitely something that you would want to understand as well.


Web development frameworks are not equal, but app developers usually make mistakes even in the most secured ones.

Managed code (high-level is a misnomer on your part) is preferred for a large variety of reasons. Since managed code relies on a VM and usually compiles to bytecode, it is uncomplicated to reverse engineer, or even decompile, to literal source code. This full knowledge approach will certainly aid penetration-testing, but secure static code analysis often requires buildable source (which almost always requires all development artifacts, especially the VM/runtime, base class libraries (BCL), and external components).

The VMs in various managed code languages may also be hardened. Some external components contain a "map" of missing features not available in the BCL. In unmanaged code (what you refer to as lower-level languages, such as C/C++/Assembler), the compiler/assembler could be hardened in a similar way as the VM, but this is an arduous task in comparison without centralization of exception handling. In this case, banned-function lists are often prescribed. Typical examples of secure external components are OWASP ESAPI for managed and Coverity Extend for unmanaged.

  • I think (but I'm not sure since the question is agreeably a bit unclear) that @Moshe meant which languages to use to perform the PT, e.g. write exploits/tests/etc.
    – AviD
    Nov 21 '10 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.