3 ms·

There are a lot of great answers on here (Python/Ruby for general scripting, C/C++/ASM for reverse engineering, web stack technology for web application securit

There are a lot of great answers on here (Python/Ruby for general scripting, C/C++/ASM for reverse engineering, web stack technology for web application security, etc) -- but I wanted to focus on a slightly different approach. I've run security teams for the last six years or so, and it's surprising to some people how little programming is often involved in penetration testing and application security assessments. If you're looking to do network and/or (web|mobile) application security, it's often unnecessary. That said: learning how to do some scripting is always beneficial, and clearly understanding how code works is very important to understanding systems, networks, and applications. My advice, though, is that if you're trying to work in security it's probably better to learn the fundamentals of the area(s) of security that interest you, rather than focusing on a programming language or framework that you think will be relevant. There are a lot of great resources out there, but shoot me an email (address in profile) if you'd like a little more info. Good luck!

tptacek 11y ago
Programming is a hard requirement for app pentesting.
- _asummers 11y ago
  I believe his point was that while you need to be able to do it, at least to a certain level, it's not where the majority of your day is going to be spent. I'm not in the field so I don't know true that is, however. That was just what I got from his post.
  - tptacek 11y ago
    I think (a) that's a common belief among pentesters and (b) a pretty dangerous trap. You don't just want to be able to program; if you want to be good at this job, you want to be a really good programmer. There are a bunch of reasons why.
- Someone 11y ago
  Programming, but not software engineering. For example, it can be merely a nuisance if the tools you write leak lots of memory, acceptable to parse XML with a regular expression, and not a problem at all if programs run entirely within an environment you control aren't themselves secure.
  - tptacek 11y ago
    OK, but it's not merely a nuisance if you can't understand why it's unsafe to parse XML with a regexp, and you might not grok the issue viscerally unless you're a good programmer.

tptacek 11y ago

Programming is a hard requirement for app pentesting.

_asummers 11y ago
I believe his point was that while you need to be able to do it, at least to a certain level, it's not where the majority of your day is going to be spent. I'm not in the field so I don't know true that is, however. That was just what I got from his post.
- tptacek 11y ago
  I think (a) that's a common belief among pentesters and (b) a pretty dangerous trap. You don't just want to be able to program; if you want to be good at this job, you want to be a really good programmer. There are a bunch of reasons why.
Someone 11y ago
Programming, but not software engineering. For example, it can be merely a nuisance if the tools you write leak lots of memory, acceptable to parse XML with a regular expression, and not a problem at all if programs run entirely within an environment you control aren't themselves secure.
- tptacek 11y ago
  OK, but it's not merely a nuisance if you can't understand why it's unsafe to parse XML with a regexp, and you might not grok the issue viscerally unless you're a good programmer.