The lost skill of scripting

Chris Burton at Pentest People discusses the importance of scripting as a vital tool in the application security testers toolbox

 

A key skill for any security professional is scripting; enabling this knowledge allows the writer to be creative and create tools for performing actions or to save time and repeat tasks relatively, and also automate long processes. As time goes on, the art of scripting is becoming rare.

 

Imagine writing a script that combines several lines of code to bypass security measures or turn a script into a payload to perform a cyber-attack. Targeting end-user devices is possible in several ways. Initially, these start with a form of Phishing, which delivers the payload by a means such as an Office document or PDF. 

 

There’s a sense of achievement from creating something new; sure, you can likely find a script someone else has authored online to do what you need, but do you trust it? Do you know what it’s doing? Would you get the same sense of achievement from deploying someone else payload or by deploying one you have authored? 

 

Why it’s important 

At its core, regardless of the tooling, scripting is a language. Language enables us to effectively communicate with technology and other professionals in the same way and to understand each other with nothing lost in translation. The world is fast expanding, and it’s now ever so crucial that there are ways for everyone and everything to communicate in the same way; when we talk about technology and software, the common practice is to structure instructions in a file commonly called "scripts".

 

Why it’s being overlooked

In the early days of technology, the internet, and even cyber security, the available tools were less vast. This led to the development of tools in various scripting languages. Over the years, because the tools exist, only a few people are learning the art of scripting.

 

I first learned BASIC at the age of 13 or 14 while in secondary school. I progressed through the years to Visual Basic, PHP and Python. Understanding numerous languages helps you understand those you are not familiar with.

 

The multiple programming languages 

If you’re keen to learn a scripting language, how do you choose from the multitude available? Some are best for web-based tasks, while others are more suited to terminal or operating system-level actions. 

• Python’s easy-to-learn and readable syntax and its rich library and framework ecosystem make it an ideal choice for beginners and experienced developers. With libraries like requests for HTTP interactions and popular web frameworks like Django and Flask, Python streamlines the process of building robust web applications. Its versatility, reliability and user-friendly interface make it a go-to choice for developers building high-quality software applications.
• Developers can leverage the power of Ruby on Rails to build web applications with a robust framework that offers creative tools beyond traditional boundaries. Ruby’s open-source nature fosters exploration, and its thriving community constantly contributes valuable "gems" that seamlessly enhance functionality in Ruby projects.
• Go (Golang) is a programming language that offers excellent support for concurrent operations through goroutines and channels. Its syntax is clean and easy to understand, making it simple to maintain code. Additionally, Go’s cross-compilation feature allows developers to quickly build for different platforms, making it a versatile choice for software development.
• As a fundamental component of front-end web development, JavaScript offers developers a wide range of libraries and frameworks to leverage. Its lightning-fast performance, cross-browser compatibility, and exceptional ability to manage asynchronous operations make it an essential tool for creating robust and innovative web applications.
• Java is an excellent choice for developers who want to create scalable and modular code. This open-source, object-oriented language has a "write once, run anywhere" philosophy, making it possible to use it across different platforms. It is a versatile language increasingly used for large-scale enterprise applications. Additionally, Java offers extensive libraries like Apache HttpClient, which can make HTTP interactions more accessible and more seamless in complex systems.
• PHP is a fantastic language for building robust applications due to its ease of learning, extensive usage in web development, and seamless integration with popular databases. Additionally, the Laravel framework is known for its powerful HTTP handling tools, which makes developing modern and scalable PHP-based projects even more straightforward.
• C# is an impressive, object-oriented language closely linked to the ASP.NET framework. Its well-structured and modular code architecture, seamless compatibility with Microsoft technologies, and consistent language development make it an excellent option for creating and managing scalable web applications. 

Prototyping and proof of concept

Scripting is a handy tool for developing proofs of concept or prototypes. It allows developers and administrators to showcase functionality while maintaining flexibility and control quickly. This empowers them to tailor solutions to their specific needs, making scripting an essential skill that can be applied across various IT and software development domains. It offers a fast and efficient way to create custom solutions to enhance productivity and efficiency while reducing errors and downtime.

 

More now than ever, it is critical to acknowledge the growing cyber threats and the changing technology landscape. One way to ensure robust security measures and efficient development practices is by recognising the importance of scripting.

 

Scripting can empower professionals to overcome complex challenges, drive innovation, and stay ahead of the curve. Therefore, it’s crucial to address the factors that lead to underestimation and leverage scripting to achieve organisational goals.

 

Get learning

If you want to develop your scripting skills, there’s no better time to start. The internet is overflowing with resources that can provide you with all the information you need to become a digital ninja in the programming world. With the advent of AI, scripting has become more accessible than ever. It’s more than understanding the technical details of how to write a script; it’s more about understanding what it needs to accomplish.

 

So, if you’re ready to take your programming skills to the next level, explore the vast resources available online and begin your journey towards becoming a master scriptwriter.

 

In the face of advancing cyber-threats and the evolving technology landscape, recognising the value of scripting and addressing the factors leading to its underestimation is paramount.

 

As organisations strive for robust security measures and efficient development practices, scripting remains an indispensable skill, empowering professionals to navigate complex challenges and drive innovation.

 

---

 

Chris Burton is Head of Professional Services at Pentest People

 

Main image courtesy of iStockPhoto.com