Which of these scripting languages is more appropriate for pen-testing? [closed]

Answer 1

Well, what kind of exploits are you thinking about? If you want to write something that needs low level stuff (ptrace, raw sockets, etc.) then you'll need to learn C. But both Perl and Python can be used. The real question is which one suits your style more?

As for toolmaking, Perl has good string-processing abilities, is closer to the system, has good support, but IMHO it's very confusing. I prefer Python: it's a clean, easy to use, easy to learn language with good support (complete language/lib reference, 3rd party libs, etc.). And it's (strictly IMHO) cool.

Answer 2

All of them should be sufficient for that. Unless you need some library that is only available in one language, I'd let personal preference guide me.

Answer 3

If you are interested in CEH, I'd take a look at Grey Hat Python. It shows some stuff that is pretty interesting and related.

That being said, any language should be fine.

Answer 4

I'm with tqbf. I've worked with Python and Ruby. Currently I'm working with JRuby. It has all the power of Ruby with access to the Java libraries so if there is something you absolutely need a low-level language to solve you can do so with a high-level language. So far I haven't needed to really use much Java as Ruby has had the ability to do everything I've needed as an API tester.

Answer 5

You probably want Ruby, because it's the native language for Metasploit, which is the de facto standard open source penetration testing framework. Ruby's going to give you:

• Metasploit's framework, opcode and shellcode databases
• Metasploit's Ruby lorcon bindings for raw 802.11 work.
• Metasploit's KARMA bindings for 802.11 clientside redirection.
• Libcurl and net/http for web tool writing.
• EventMachine for web proxy and fuzzing work (or RFuzz, which extends the well-known Mongrel webserver).
• Metasm for shellcode generation.
• Distorm for x86 disassembly.
• BinData for binary file format fuzzing.

Second place here goes to Python. There are more pentesting libraries available in Python than in Ruby (but not enough to offset Metasploit). Commercial tools tend to support Python as well --- if you're an Immunity CANVAS or CORE Impact customer, you want Python. Python gives you:

• Twisted for network access.
• PaiMei for program tracing and programmable debugging.
• CANVAS and Impact support.
• Dornseif's firewire libraries for remote debugging.
• Ready integration with WinDbg for remote Windows kernel debugging (there's still no good answer in Ruby for kernel debugging, which is why I still occasionally use Python).
• Peach Fuzzer and Sully for fuzzing.
• SpikeProxy for web penetration testing (also, OWASP Pantera).

Unsurprisingly, a lot of web work uses Java tools. The de facto standard web pentest tool is Burp Suite, which is a Java swing app. Both Ruby and Python have Java variants you can use to get access to tools like that. Also, both Ruby and Python offer:

• Direct integration with libpcap for raw packet work.
• OpenSSL bindings for crypto.
• IDA Pro extensions.
• Mature (or at least reasonable) C foreign function interfaces for API access.
• WxWindows for UI work, and decent web stacks for web UIs.

You're not going to go wrong with either language, though for mainstream pentest work, Metasploit probably edges out all the Python benefits, and at present, for x86 reversing work, Python's superior debugging interfaces edge out all the Ruby benefits.

Also: it's 2008. They're not "scripting languages". They're programming languages. ;)

Answer 6

metasploit is a great framework for penetration testing. It's mainly written in Ruby, so if you know that language well, maybe you can hook in there. However, to use metasploit, you don't need to know any language at all.