[Faith Connors]

I've seen the same thread in here all the time so I'm gonna try to clear it up.

This question has existed in here as long as I remember my time in here. It shows up every few days, a new member asking what language is the best for hacking. Of course, it depends what you're trying to do, but I'm going to clear it up to the best of my ability. First of all there are three main language types, Markup, Programming, and Query.

---

Markup Languages:
Markup languages are probably the most useless languages, but are the easiest to learn. I use that term a bit sparingly so I'll give my two cents on it.

Unlike programming languages, markup languages are very static in the terms that they don't actually do anything on their own. Markup languages are made to format text, maybe style it. If you've spent time in here, you'll see people recommend learning HTML and CSS. These languages are markup, they're for building websites. HTML is literally an acronym for "HyperText Markup Language." Now, you're wondering how they get all kinds of fancy buttons and how stuff actually happens in your favourite online game that claims to be written in HTML5. Well the truth is, the game isn't written in HTML5. Maybe the site hosting the game is, but the game itself is probably JavaScript or some other scripting language. I'll talk about scripting languages with programming languages a bit later, but for now we're on markup languages.

HTML and CSS are probably the most common languages people know because they're simple, but to be honest those are the only markup languages people will have heard of, there are many more, and some I find more useful than others. Although markup languages are much easier to code in, you can do some really interesting stuff with them, not just building websites.

Another really popular markup language is the eXtensible Markup Language, AKA XML, and it's HTML counterpart, XHTML. Many people have heard of this one but don't really know what to do with it. It may very well be my favourite markup language because of its flexibility. I even used it to fix up and make some mods for a game called Mabinogi, a few years ago. Another markup language is made by Adobe, a bit different than either of the ones I mentioned, but relatively powerful in conjunction with their application environment. This language is CFML, the ColdFusion Markup Language. It's for deploying your ColdFusion applications online. So yeah, markup languages aren't "completely useless," but they're much simpler than actual programming languages, and don't really do as much.

I would recommend trying to learn a markup language if you are a complete beginner and have never touched a line of code before, or even seen one.

---

Programming Languages:

Everyone seems to classify languages as programming languages when they clearly aren't, so I'm gonna try and clear some of this up. Programming languages are the languages used to actually make applications. This is what your favourite online game is made in, that software at work you hate, the operating system and web browser you're using right now. Most of it is an actual programming language (maybe some XML for logs and stuff.)

Programming Languages are a little bit of a broad area. You see, first you have to divide it into two completely separate areas. There are compiled languages and there are interpreted languages.

Compiled Languages:

Now, if you are a hacker, and you write malware, this is the kind of language you want to learn. When a program written in a compiled language runs, the code is hidden, and that makes it harder for an antivirus to detect that it's a virus. So as a result most malware is written in a compiled language. Now, it also depends what specific language you're after. There are two more sections we can divide into, Native and Runtime.

Remember the day you got your new computer and it was a while ago and you wanted to play Minecraft, but because Minecraft is a Java game, you needed to install Java first?

Well, first of all what exactly were you installing?

You installed the JRE, the Java Runtime Environment. You see, by default, Windows doesn't have support for running Java programs, so when it prompted you to go and download Java, it was asking you to download the libraries and all the packages you need to run Java applications. The other side of this is Native Languages

Now, a Native language means the language will work by default on the operating system without any runtime. This is because when it is compiled, it isn't compiled in a way that it requires all the libraries and packages that the runtime needs to provide it, instead when the compiler, well, compiles the program, it converts it all into machine code, aka the 0's and 1's that everyone thinks is hacking if you pull it up in a public place. This is the barebones code and operates on such a basic level that the hardware itself could interpret it on its own. When that's all converted to text, you can see it's just Assembly code, the one-step-above machine code that is incredibly hard to write on your own, but can be converted with the right compiler, like the GNU-Cross-Compiler (GCC.)

Enough about compiled languages, we want to get into interpreted languages.

Interpreted Languages

I'm going to just copy and paste surelyenough's (UID=3217184) edit suggestion because it makes sense and there's probably no other way I could write it.

Memory formation is not why malware developers ignore Python. In fact, memory is much more complicated when you're using a language like Python because almost everything is an object that is dynamically allocated on the Heap and not the Stack segment of our memory segmentation. Write simple code in C, you'll see the memory formation actually is very very clear. Function prologues, stack formation, allocations etc. It all makes beautiful sense. Python on the other hand...

You don't write malware in Python because Python is interpreted, not compiled. Meaning that I'm supposed to execute your malware through python instead of accidentlly executing it natively through whatever means (Opening it, or having my browser run it as an exploit, or having another form of malware run it). If you'll want it bad enough, you can actually use py2exe or whatever it's called as a compiler to Python. However, it's slow, inefficient and not the purpose Python was made for. You write malware in fast, efficient languages that are as low as they can get to the bones of your PC. There is no point in sugar-coating code when dealing with malware.

Ruby is a pretty old language, been around since 1995 and it's still very commonly used today, in an environment called Metasploit. It is used to create payloads, think of it like malware but sent to specific targets so they can be exploited like vulnerabilities. It's a rather flexible language, been used for all kinds of things, and it's even making a comeback in game development, if you've ever heard of RPGmaker.

Python is another example of an interpreted language, a scripting language. It's easy to pick up because the syntax is simple, and it's powerful if you're using all the right libraries and know what you're doing. It's been recently used to start making payloads in Metasploit as well.

Honestly I just like interpreted/scripting languages because they're relatively simple and are good for automation. We all hate doing repetitive menial tasks, right?

---

Query Languages:

Query languages are the last type of language I'll be talking about, although it's very different than anything we've seen here so far.

We're gonna take a look at SQL for the most part here. SQL is the acronym for Structured Query Language. It's what allows a user to communicate with a database and call up data. You give it a query, and it gives you a response.

MySQL is commonly mistaken as a query language, as I did prior to this edit. MySQL is actually a piece of software which acts like a query language, but has slight variations in syntax, and once it receives the query in its syntax, it'll convert it to the actual SQL query, which can be understood by the software hosting the database. This is what we call a Database Management Service, DBMS for short.

Now, a little bit about APIs. I'm aware that APIs are very different than actual query languages or whatever, but it's probably important that I talk about them a little bit in here. API is an acronym for Application Program Interface. In it's own way it can help you program things, almost like using building blocks to figure out how you can get something to work.

Let's say I have something called a proxy rotator. What it does is calls up a server to give me a random proxy from a list. Now, I could implement this in a program to make it look like I'm accessing a website or some server from all kinds of different connections, just by making the API pull a proxy from its server every time my program wanted to make a request.

I could also use a scraping API. It would help me get data off of a website much more easily. Pastebin offers an API which can help you get the 1000 most recent pastes, for data mining, other general research and so on.

So in a way an API can be considered a "query language" but doesn't actually hit the mark because it isn't a language in itself, it runs off some sort of language already. APIs can be used in most of the most popular languages already, like Python and Node.JS

---

So what are you going to do with all this information? Well hopefully you understand the difference between different types of languages now, and know what kind of language you're hoping to learn. I've compiled a small list of resources you can use to try and find some languages and where to learn them.

https://www.codecademy.com/ is a great resource for web-development. They have courses on HTML and CSS, JavaScript, PHP and Python.

http://www.w3schools.com/ is a little like codecademy, but it doesn't hold your hand as much. It'll help you start to learn on your own.

https://github.com/vhf/free-programming-...g-books.md is a fantastic resource to find every possible language you can think of, and some books for you to learn them.

http://www.programmableweb.com/ A huge directory and listing of thousands of APIs. Take your pick.

Here's a list of good languages that are still used today and are powerful.

Perl - Scripting language, old but still used
Python - Scripting language, relatively new, widely used
Ruby - Old, making a comeback, flexible and powerful
C# - Been out for a while but people only started to notice it now for how powerful it is.
Java - Was dominating the market because of cross-platform, but it's losing speed recently.
C - The original, the powerful, it'll teach you everything you need to know.
PHP - Used for web development and scripting. It's all server side.
SQL - Query language, for calling up data from databases online. Used in SQL injections, a web vulnerability/exploit.

If there is any bad info in here, let me know and I'll fix it. Sorry, I'm still coming down from painkillers.

To all new members, welcome to HackForums and enjoy your stay.

~Faith


EDITS:
-Added ProgrammableWeb to list of resources.

EDIT SUGGESTIONS COURTESY OF UID=3217184, surelyenough

-About native languages
-Some edits to APIs
-Edits to Query Languages

[SIM-2914476]

"PHP - Used for web development and scripting. It's all server sided."
No need for the "d" at the end.

---

Also take advantage of

Code

[hr]

to seperate.
Otherwise nice job OP.

[Faith Connors]

"PHP - Used for web development and scripting. It's all server sided."
No need for the "d" at the end.

---

Also take advantage of

Code

[hr]

to seperate.
Otherwise nice job OP.

Oh shit thanks for the heads up

[dendro]

Thanks for the hq thread good stuff op :)

[Faith Connors]

Thanks for the hq thread good stuff op :)

When you're bed ridden, you've got time to kill, and when you have a laptop, you may as well waste it online :^)

[Z3r0C0d3]

Programming Languages are a little bit of a broad area. You see, first you have to divide it into two completely separate areas

Actually , there are 3 types , Low level , High level(Compiled Languages) and Interpreted , the low level programming language doesn't require compiler because they are close to the machine code , example for low level language is Assembly

[surelyenough]

Actually , there are 3 types , Low level , High level(Compiled Languages) and Interpreted , the low level programming language doesn't require compiler because they are close to the machine code

Not exactly accurate. Low Level programming (Assembly) requires "a compiler". It's called an assembler. Some examples of them: NASM, FASM, MASM, etc.
You're correct in the sense that assemblers are not actually turning code into object files only to group them together in order to perform linking according to the symbol table. That's the job of GCC. The assembler simply takes out the mnemonics we've put in, puts the machine code instead according to it's specific dialect (8086 & NASM on x86_64 etc) so it's a simpler job, but it still creates a binary executable, it'll still segment your binary, it'll still sort out your ASM accordingly to the "compile" flags. Not a compiler, But it still needs to have something go through your assembly.

Anyway, Good thread, I like it. Some constructive criticism.

Languages like C and Delphi are examples of languages that will run by default on a Windows machine, without having to install anything else. This is usually because the operating system is already written in the same language.

Not really. If you'll take Rust, another generic-purpose high-level compiled language, and start writing code and compiling it you'll find out it'll work straight out the box. The reasoning for that is these are natively-copmpiled language. Meaning that these compilers that go through the language start a procedure that will eventually convert the code to machine code according to the demands of the enviroment and workspace. The output file is a binary executable that is written in 0's and 1's, if you'll go with it through a dissasembler you'll find out the machine code actually makes sense and can be viewed as Assembly. Your PC simply reads the instructions and does them. Now, if your writing tried to aim for "being able to write OS-depended services" these are libraries. *nix has POSIX. Windows has WinAPI. Each provides a huge API for the coder to be able to talk with the OS. So yeah, basically any programming language can be native and it has nothing to do whether the OS was written in the same language.

Interpreted languages make all the code visible in the memory when running, so if you try to write malware in these kind of languages, it's going to be very hard because antiviruses will automatically detect what you're trying to do as soon as it runs. But scripting languages aren't all useless in the hacking world.

Memory formation is not why malware developers ignore Python. In fact, memory is much more complicated when you're using a language like Python because almost everything is an object that is dynamically allocated on the Heap and not the Stack segment of our memory segmentation. Write simple code in C, you'll see the memory formation actually is very very clear. Function prologues, stack formation, allocations etc. It all makes beautiful sense. Python on the other hand...

You don't write malware in Python because Python is interpreted, not compiled. Meaning that I'm supposed to execute your malware through python instead of accidentlly executing it natively through whatever means (Opening it, or having my browser run it as an exploit, or having another form of malware run it). If you'll want it bad enough, you can actually use py2exe or whatever it's called as a compiler to Python. However, it's slow, inefficient and not the purpose Python was made for. You write malware in fast, efficient languages that are as low as they can get to the bones of your PC. There is no point in sugar-coating code when dealing with malware.

---

I'd recommend a rewrite for the Query Languages thing, the only actual query-structured language (that is popular) is SQL. API's aren't really languages, they are however critical system components and are important. There are specifications on how to write APIs such as SOAP while making them RESTful. These are technologies that have similarities to languages in how strict they appear however they're not languages.

MySQL is a DBMS not a language. It's a program that breaks down MySQL SQL dialect and executes it. Other DBMS include MsAccess, MSSQL, Oracle, PostgreSQL etc. The differences between them are minor, and usually revolve around syntax.

---

AKA XML, and it's HTML counterpart, XHTML.

Isn't XHTML simply a strict HTML standard. Just like HTML 4.0. I learnt something new today as well, see? :) Thanks.

---

When a program written in a compiled language runs, the code is hidden, and that makes it harder for an antivirus to detect that it's a virus

This isn't how it really works... The "code" isn't hidden. There is no code. There is machine code, and it's located at the code segment: https://en.wikipedia.org/wiki/Code_segment
As for AV bypassing, it has little to do with language choice and more to do with your abilities as a malware developer. Knowing what to hook, what to dynamically link, what to use where is the real skill. I can not detail about this in public. PM me if you have questions in this field.

I'd recommend you do an entire overhaul to this thread because it has serious potential to be very good.

[Faith Connors]

Not exactly accurate. Low Level programming (Assembly) requires "a compiler". It's called an assembler. Some examples of them: NASM, FASM, MASM, etc.
You're correct in the sense that assemblers are not actually turning code into object files only to group them together in order to perform linking according to the symbol table. That's the job of GCC. The assembler simply takes out the mnemonics we've put in, puts the machine code instead according to it's specific dialect (8086 & NASM on x86_64 etc) so it's a simpler job, but it still creates a binary executable, it'll still segment your binary, it'll still sort out your ASM accordingly to the "compile" flags. Not a compiler, But it still needs to have something go through your assembly.

Anyway, Good thread, I like it. Some constructive criticism.
Not really. If you'll take Rust, another generic-purpose high-level compiled language, and start writing code and compiling it you'll find out it'll work straight out the box. The reasoning for that is these are natively-copmpiled language. Meaning that these compilers that go through the language start a procedure that will eventually convert the code to machine code according to the demands of the enviroment and workspace. The output file is a binary executable that is written in 0's and 1's, if you'll go with it through a dissasembler you'll find out the machine code actually makes sense and can be viewed as Assembly. Your PC simply reads the instructions and does them. Now, if your writing tried to aim for "being able to write OS-depended services" these are libraries. *nix has POSIX. Windows has WinAPI. Each provides a huge API for the coder to be able to talk with the OS. So yeah, basically any programming language can be native and it has nothing to do whether the OS was written in the same language.

Memory formation is not why malware developers ignore Python. In fact, memory is much more complicated when you're using a language like Python because almost everything is an object that is dynamically allocated on the Heap and not the Stack segment of our memory segmentation. Write simple code in C, you'll see the memory formation actually is very very clear. Function prologues, stack formation, allocations etc. It all makes beautiful sense. Python on the other hand...

You don't write malware in Python because Python is interpreted, not compiled. Meaning that I'm supposed to execute your malware through python instead of accidentlly executing it natively through whatever means (Opening it, or having my browser run it as an exploit, or having another form of malware run it). If you'll want it bad enough, you can actually use py2exe or whatever it's called as a compiler to Python. However, it's slow, inefficient and not the purpose Python was made for. You write malware in fast, efficient languages that are as low as they can get to the bones of your PC. There is no point in sugar-coating code when dealing with malware.

---

I'd recommend a rewrite for the Query Languages thing, the only actual query-structured language (that is popular) is SQL. API's aren't really languages, they are however critical system components and are important. There are specifications on how to write APIs such as SOAP while making them RESTful. These are technologies that have similarities to languages in how strict they appear however they're not languages.

MySQL is a DBMS not a language. It's a program that breaks down MySQL SQL dialect and executes it. Other DBMS include MsAccess, MSSQL, Oracle, PostgreSQL etc. The differences between them are minor, and usually revolve around syntax.

---

Isn't XHTML simply a strict HTML standard. Just like HTML 4.0. I learnt something new today as well, see? :) Thanks.

---

This isn't how it really works... The "code" isn't hidden. There is no code. There is machine code, and it's located at the code segment: https://en.wikipedia.org/wiki/Code_segment
As for AV bypassing, it has little to do with language choice and more to do with your abilities as a malware developer. Knowing what to hook, what to dynamically link, what to use where is the real skill. I can not detail about this in public. PM me if you have questions in this field.

I'd recommend you do an entire overhaul to this thread because it has serious potential to be very good.

Shit man thanks for the heads up, I'll be adding stuff to it later, I feel like I'm about to pass out right now lmao.

[surelyenough]

Shit man thanks for the heads up, I'll be adding stuff to it later, I feel like I'm about to pass out right now lmao.

no worries it's all good

[Faith Connors]

no worries it's all good

Alright mostly edited to your suggestions. Decided not to put in the last bit because malware = bad and bad is not allowed on HF. But still, great suggestions.

[Faith Connors]

Just gonna bump this thread in regards to recent threads of users asking where to start and other users responding. Lots of information here, take advantage of it.

[~ Left HF For Good ~]

Faith, would you mind if I added your thread link into my thread? Of course, it would link to your thread, and you will have credits!

[Faith Connors]

Faith, would you mind if I added your thread link into my thread? Of course, it would link to your thread, and you will have credits!

I already asked you in like the third post lmao

[~ Left HF For Good ~]

I already asked you in like the third post lmao

Oh my, I am so sorry! I must not have seen it. Let me go back to my thread. 🙂

Edit: Added it to my thread, as well gave you credits. Thank you very much, Faith!

[Arkks]

tbh it all depends what you trying to do. if you heading into botnets C and web deb is a good place to go but if your working on tools and other fun stuff go towards c# and .net