C/C++ vs Java

[erhardm]

Hi!

I know this questions is not part of backtrack but it's pentesting related:

I got a job offer working as programmer in java, but I'm confused about how would this help my career.

My career plan is to work ~3 years in programming(in parallel to work on CCNA, some entry level pentesting), another ~2years in network programming( to have programming expertise in networking, maybe to develop some CCNP skills, take advanced Offensive Security certifications), another ~ 2years in some ASM( not necessary only ASM, but to have a some expertise in it), after this, a job in pentesting/security.

I think (for me) this is the right path to work in pentesting&security.

I don't know for sure, but my guess is that the most important programming languages in pentesting would be C/C++,ASM,Perl/Python/Ruby + web development, but it's just a guess. How could Java help me? Is there a great demand in Java as security expert? Greater than the others mentioned above?

I'm interested what the senior developers would say about this. I really want to hear some thoughts from those who work in the field and have senior experience in this. However I won't disregard the opinions on those who are only at the beginning of the road.



Best Regards

[thorin]

IMHO it's irrelevant. If you can code in Java you can code is most relevant modern languages.

A loop is a loop is a loop, the syntax may very slightly from language to language but basically they all boil it down to start here (a), go here (z), and optionally increment by something (m), stop when here (z) is reached or exceeded (or whatever necessary condition is met).

The nitty gritty differences in inheritance, polymorphism, garbage collection, syntax etc can be picked up really quickly once you realize that it's almost all the same.

No single language is going to make or break your pen testing career, the thing that's important is understanding how to design things logically and robustly.

[iliyapolak]

How CCNP can be related to network programming?.My advice is do not spend money on entry-level Cisco certs, instead purchase some CCIE level books about the networking concepts like :switching ,routing , mpls.
Great books about the topics mentioned above are: TCP/IP Illustrated , Routing TCP/IP , Cisco LAN Switching.Learn those concepts to gain knowledge also read RFC's.
Next study Windows internals , network stack , NDIS driver stack, also learn some debugging and API dissasembling.Do not forget that professional pentester knowledge is based on the theory of Operating System internal architecture.
Regarding programming languages if your path is to write exploits learn x86 assembly language , read Intel processor manuals, study hard C language.
I would also recommend linux books about the kernel and networking.

[erhardm]

IMHO it's irrelevant. If you can code in Java you can code is most relevant modern languages.

My opinion is that if you code Java for n years you can't get a job in C/C++ as senior developer. It would be a step back for your career because you won't have the same expertise. This concerns me. I have to pick wisely the main programming language(of course you won't know only one programming language), where I should work, so I could gain experience and use that in penetration testing.

Regards

[thorin]

My opinion is that if you code Java for n years you can't get a job in C/C++ as senior developer.

True however pentester != senior developer.

Seems like you need to decide what you actually want to do with your career.

[erhardm]

True however pentester != senior developer.

I think it's more like pentester > senior developer.
You have to know as much as possible of the inner workings of the applications you want to exploit & inner workings of techniques you use to exploit. In house pentester has to know more than the developer, he has to provide a patch to a problem(something that the developer didn't considered it being a problem before the assessment, hence he implemented it in that way). Blind penetration testing would also imply knowing the inner workings as much as possible to choose the right tools or develop new ones if needed.

Back to my original question, how would Java influence my future pentester career? Would it be better to be (mainly) a C/C++ developer?


Regards

[thorin]

Yes and no (mostly no....IMHO).

You'll never be able to know more than the developer unless you're talking about becoming a software tester for a specific company/product (which again isn't really a pen tester). Your job as a pen tester (contracted to 3rd parties or other groups within an organization or Gov't department) is to know or come up with things your client's Sr developer(s) didn't.

There is no guarantee that your target will be coded in C, C++, Java, Python, Ruby, etc hence you need to be a jack of all trades....which leads to being a master of none. Well really you need to be a master of thinking outside the box.

As a pen tester you shouldn't have to provide code fixes. You should simply have to say the target you assessed failed in this way when subjected to this type of input or interaction. It's up to the actual target or product owners/developers to figure out how to specifically address those conditions and the associated failure.