Is the Java programming language used for penetration testing in practice?

I've wondered whether Java is used or can be used for penetration testing in the field (people write pen-testing suites and attacks in Java)?

If so, does the same apply to C#?

I know Python and Ruby are used a lot, but I would like to aim for specializing in Java, since it applies to many domains.

Could someone with experience in the field answer my question?


1 Answer 1


You can write penetration testing tools in Java or C#.

Armitage is evidence of this. And you can search for vulnerabilities in Java code but not vulnerabilities like buffer overflows or format strings. I don't know the name of these vulnerability types but let's say that if a condition is wrong and with given input it grants you some privileges. Also Java is good because Android has a massive entry in today's technology.

  • why can't Java test for buffer overflows? Is that because of the JVM and GC?
    – Thufir
    Nov 30, 2017 at 13:01
  • You can produce vulnerable software using Java too, I recently heard lots of object deserialization attacks for Java applications. Jan 24, 2018 at 21:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .