So recently I have been working on some projects one of them is keylogger and the second is SYNflood (both in python). I want to know if ,is it a good practice to use python language for such purposes? (Maybe you know from your own experience)

  • You can use Python to send your shellcode, it's quick and easy to setup listening sockets and what not for keyloggers. But your exploit code itself will most likely not be written in Python. – RoraΖ Jan 8 '15 at 12:26
  • may explain please,why python isnt good for such purpuse? and suggest another language to do so? – Yakov Mor Jan 8 '15 at 12:29
  • 1
    When you use C and other low level language you can create small size file.When you use other kind of programming language like python ,your final size of file is much bigger than others.Some cases, size of file is important. – dgn Jan 8 '15 at 13:08
  • The target computer must also have python installed for the keylogger to run. You can however ship python with your keylogger, but as @dgn said, the size will increase. – Grimmjow Jan 8 '15 at 13:30
  • @YakovMor It really depends on what you want to do, but Python is an interpreted language. You can create compiled Python, but to access a lot of the constructs in an operating system lower level languages provide APIs to make this easier. You don't want to be doing system calls in Python. – RoraΖ Jan 8 '15 at 13:43

About writing tools like this SYNFlood, python is as good as any other language you feel comfortable with. There is an excellent book called "Violent Python" where you will learn to write security auditing tools and malwares. From network scanners, login bruteforcers, FastFlux behavior to mimicking botnet functionalities, you will learn a lot about them.

Writing malware in python can make your life easier (in a part) as it is very quick and easy to code. Python is really an uncommon choice for viruses and the like because it needs an installed interpreter to run. You may overcome that by turning the script into a windows executable using available tools (like py2exe), but that tends to produce big executables (maybe 5MB, depending on the imported modules) and as malware tend to survive on its subtlety, it may be spotted sooner than you expect, not only because of executable size but also memory footprints.

Compiled python scripts can be turned back to its script form with great ease, using modules like uncompyle2. Once it is found, that will allow the malware analyst to quickly know what it does, how it does, where the command and control servers are, etc., making it extremely fast to uncover your whole operation and reducing the effectiveness of your malware as AV vendors push your signature into their products.

On the other side, as someone said in this reddit post about a Bluecoat report (linked below), AV detection rate for scripted languages tend to be low, as many installers use them to deploy softwares.

Doing some more research, i heard about the Flame malware and according to the article, it was 20MB in size, including libraries, sqlite databases and all. So, size may not be "that great burden" after all...

Here is a report from the security company Bluecoat about a python malware that relates to the Hangover operation in 2013.

Most malware are written using C/C++/C#, VB, Assembly, .NET, etc., but that is not a law. These languages have advantages, but also does python. Everything depends on your goal. Balance what you want with what you need and take your shot with what feels the best option to fulfill them.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.