Which languages are better for attacks against websites?

Question

Which languages are better for writing tools for attacking websites, through, say, a DDOS? High level, low level, and does it even make a difference?

Answer 1

Hmm, I would have to say Python, Bash and/or Perl. Why? Well they are installed by default on most of *NIX platforms (most of the web servers) and are easy to program for a quick hack (again I'm talking hacking code).

DISCLAIMER: I am not promoting penetration attacks :D

Answer 2

It depends on what you are trying to do and what you are comfortable with. Any modern language has what you need to carry out attacks against web sites.

High level dynamic languages (e.g. python, ruby) can make working with different protocols fairly easy and have plenty of packages that also make it very easy to parse different data without having to code a lot of it yourself.

I've been moving a lot of my development to python (as much as I can). I still use C,C++ for systems level stuff but I think that is a bit too low level for how I am interpreting your question.

I would also say that learning Javascript and SQL is definitely something that you would want to understand as well.

Answer 3

Web development frameworks are not equal, but app developers usually make mistakes even in the most secured ones.

Managed code (high-level is a misnomer on your part) is preferred for a large variety of reasons. Since managed code relies on a VM and usually compiles to bytecode, it is uncomplicated to reverse engineer, or even decompile, to literal source code. This full knowledge approach will certainly aid penetration-testing, but secure static code analysis often requires buildable source (which almost always requires all development artifacts, especially the VM/runtime, base class libraries (BCL), and external components).

The VMs in various managed code languages may also be hardened. Some external components contain a "map" of missing features not available in the BCL. In unmanaged code (what you refer to as lower-level languages, such as C/C++/Assembler), the compiler/assembler could be hardened in a similar way as the VM, but this is an arduous task in comparison without centralization of exception handling. In this case, banned-function lists are often prescribed. Typical examples of secure external components are OWASP ESAPI for managed and Coverity Extend for unmanaged.