So recently I have been working on some projects one of them is keylogger and the second is SYNflood (both in python). I want to know if ,is it a good practice to use python language for such purposes? (Maybe you know from your own experience)
closed as off-topic by RoraΖ, GdD, Jens Erat, Xander, AJ Henderson Jan 8 '15 at 16:21
This question appears to be off-topic. The users who voted to close gave these specific reasons:
- "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – GdD, AJ Henderson
- "This question does not appear to be about Information security within the scope defined in the help center." – RoraΖ, Jens Erat
About writing tools like this SYNFlood, python is as good as any other language you feel comfortable with. There is an excellent book called "Violent Python" where you will learn to write security auditing tools and malwares. From network scanners, login bruteforcers, FastFlux behavior to mimicking botnet functionalities, you will learn a lot about them.
Writing malware in python can make your life easier (in a part) as it is very quick and easy to code. Python is really an uncommon choice for viruses and the like because it needs an installed interpreter to run. You may overcome that by turning the script into a windows executable using available tools (like py2exe), but that tends to produce big executables (maybe 5MB, depending on the imported modules) and as malware tend to survive on its subtlety, it may be spotted sooner than you expect, not only because of executable size but also memory footprints.
Compiled python scripts can be turned back to its script form with great ease, using modules like uncompyle2. Once it is found, that will allow the malware analyst to quickly know what it does, how it does, where the command and control servers are, etc., making it extremely fast to uncover your whole operation and reducing the effectiveness of your malware as AV vendors push your signature into their products.
On the other side, as someone said in this reddit post about a Bluecoat report (linked below), AV detection rate for scripted languages tend to be low, as many installers use them to deploy softwares.
Doing some more research, i heard about the Flame malware and according to the article, it was 20MB in size, including libraries, sqlite databases and all. So, size may not be "that great burden" after all...
Most malware are written using C/C++/C#, VB, Assembly, .NET, etc., but that is not a law. These languages have advantages, but also does python. Everything depends on your goal. Balance what you want with what you need and take your shot with what feels the best option to fulfill them.