Is the Java programming language used for penetration testing in practice?

I've wondered whether Java is used or can be used for penetration testing in the field (people write pen-testing suites and attacks in Java)?

If so, does the same apply to C#?

I know Python and Ruby are used a lot, but I would like to aim for specializing in Java, since it applies to many domains.

Could someone with experience in the field answer my question?


You can write penetration testing tools in Java or C#.

Armitage is evidence of this. And you can search for vulnerabilities in Java code but not vulnerabilities like buffer overflows or format strings. I don't know the name of these vulnerability types but let's say that if a condition is wrong and with given input it grants you some privileges. Also Java is good because Android has a massive entry in today's technology.

  • why can't Java test for buffer overflows? Is that because of the JVM and GC? – Thufir Nov 30 '17 at 13:01
  • You can produce vulnerable software using Java too, I recently heard lots of object deserialization attacks for Java applications. – Kerim Can Kalıpcıoğlu Jan 24 '18 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.