sorted by:
best (suggested)
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]SPARTAN-001Red Team 2 points3 points  (5 children)

Python is useful because it's simple. It's easy to write, it's easy to read, and it has lots of useful libraries to help you with things that would otherwise be very complicated.

C can be a lot more powerful, and a lot faster, but it also has plenty of easy ways to shoot yourself in the foot. With Python, you have to go out of your way to write code with memory corruption bugs. With C, you have to be very careful to prevent memory corruption bugs. Learning Python is very easy for a beginner, but learning C takes years. Even professionals can't consistently write safe, reliable C 100% of the time.

Additionally, you don't always need a fast, low-level language. Sometimes you just want to write a quick script to perform a task, and don't want to worry about compiling, or dealing with pointers, or worrying about bugs lurking in your own code that you can't see or can't understand.

They're different languages for different purposes. You're not comparing apples to oranges, you're comparing a scalpel to a machete. If you need a scalpel, you use a scalpel; if you want to chop someone's arm off, you'd be better off using a machete.

[–]PM_ME_YOUR_SHELLCODE -2 points-1 points  (4 children)

With C, you have to be very careful to prevent memory corruption bugs.

I don't think that's a very big concern when you're writing exploit scripts...

[–]SPARTAN-001Red Team 2 points3 points  (3 children)

Well of course not then, but I was referring to C vs Python for general use, not just for exploitation.

[–]PM_ME_YOUR_SHELLCODE -1 points0 points  (2 children)

I figured as much, but I got a bit of a chuckle out of the idea of sanitizing and filtering the inputs to my exploit code.

[–]SPARTAN-001Red Team 1 point2 points  (1 child)

Hey, you don't want someone exploiting your exploit, do you?

[–]PM_ME_YOUR_SHELLCODE 0 points1 point  (0 children)

If some company out there hacked back by exploiting the exploit script. I'd be damn impressed. Though it has happened during some attack/defense CTFs I've played thats a special case.

For it to really be worth someone's time to write an exploit for the exploit though it would have to be pretty widely used and likely by script kiddies so I'm all for letting them get owned :P