Programming Languages

Programming Languages

Specific Programming languages.

There are certain programming languages that you should know in order to be a cyber security researcher.

C / C++ – These are important languages to know for cyber security research. C was made to write an operating system. It works well dealing with devices and hardware; byte streams and manipulating bits. All major operating systems—Windows, Linux, Unix—are written in C/C++. Browsers like Firefox and Chrome are written in C. Phone operating programs like Asterik are written in C. Lots of networking programs, Internet connectivity software is written in C. Games are written in C. iPhone apps are written in a flavor of C. Android apps can be written in C. I hope you see, that C is an important programming language to know, if you want to do any kind of network or Internet reverse engineering.

IMHO, the best book on C, is “The C Programming Language” by Brian W. Kernighan and Dennis M. Ritchie. They made the C language. This is the C bible.

First study C, get the hang of it. Then, study C++. C is less complicated and is RISC, “Reduced Instruction Set Computing”. RISC is faster and has less commands, which make programming easier. C++ has a large amount of libraries and extra commands. You probably won’t be needing all of them. This complexity makes C++ not as portable as C. Meaning, programs in C are easily transferred and adapted to other machines. Not so programs in C++ or other languages.

Whatever you write in C, will be compiled by a C++ compiler, with certain considerations. You must put your routines at the top and not the bottom of the program. Before the main, NOT after it. That’s about all.

You can get free C/C++ compilers and IDEs (Interactive Development Environments) such as Dev-C++; available at http://orwelldevcpp.blogspot.com/.

Also, there is Visual Studio by Microsoft, which is now free. Beware, that you will probably get some errors after installing it.

Also Eclipse which is a very popular IDE, has a C/C++ version/module.

C is an old time “linear” language”. Programs have a start and stop. Programs follow the sequence from first instruction to last instruction. C++ is “Object Oriented Programming”. More on that later.

C is a compiled language. You have to “compile” your program to get a runtime module, exe file, something that your computer can run. The alternative is an “interpretive” language. In an interpretive language, each command is executed, done in sequence, individually. One by one, the commands are turned into machine instructions and executed. This is slower than a compiled language. However, this has the advantage of giving immediate results and knowing exactly where and how your program is not working

If you are trying to find something, if you are manipulating data to find a specific piece of information, using an interpretive language can be very useful.

Python – Is an interpretive language that is very common among hackers, cyber security researchers, hobbyists and computer enthusiasts. Python was written by programmers for programmers. Python includes lots of programming features. Python was written by programmers for programmers with every conceivable programming feature ever wanted. This is why it is so popular among computer scientists.

It is crowd sourced, open source and free. It has many libraries and all sorts of addons, packages, that have been developed to do all sorts of things, that programmers, computer scientists and cyber computer security researchers want to do. For example, there are all sorts of functions and libraries to surf the web, “scrub” web pages—extract information from web pages and analyze web connectivity. There is also a web server service written for Python.

You can find Python at https://www.python.org/

You can get Beautiful Soup for web page scrubbing at https://www.crummy.com/software/BeautifulSoup/

You can get the Python web server Cherry Py at http://cherrypy.org/

“Python For Dummies” should be good enough to get you started.  Do not frown or demean the “For Dummies” series.  You can learn a lot of basics and get good foundational knowledge from reading these books.  They have a wealth of books about various computer subjects.

Javascript – A lot web pages use Javascript as the script language for processing. In addition, Javascript is becoming a language in its own right. Javascript is very much like C. Once you have learned C, learning Javascript should be easy. There are some slight differences.

Since so many web sites use Javascript, there is a large need for cyber security researchers who know Javascript and can find weaknesses and bugs in Javascript programs. Meaning, web pages written with Javascript.

W3Schools is an excellent resource. http://www.w3schools.com/ There are lots of courses about web technologies, including a course on Javascript. I recommend it.

For a nice freebie IDE (Interactive Development Environment) that does Javascript and other web page development, check out Bluefish at http://bluefish.openoffice.nl/index.html

SQL – Is a standard language for working with databases such as MySQL, Oracle and Microsoft Database. Each database will have its own flavor of SQL. But, core commands will be the same. Since most web sites will have a database, I highly recommend learning some SQL.

SQL is an English style language. For example, “SELECT employees FROM factory1 WHERE salary < 10000” I think you know what data I am looking for.

W3Schools, mentioned above, has a section on SQL. That, and doing the challenges on HackerRank.com should give you sufficient knowledge of SQL to get started.

HackerRank.com is a web site dedicated to hacking. Challenges in many different languages are presented. Also, challenges by type—math, algorithm (method of solution), endurance, speed of solution—are presented. The challenges are usually practical and the kind of things, skills and abilities, that employers are looking for. In fact, employers run challenges and troll the rankings looking for programmers. There are prizes. IMHO, a very worthwhile site. It will give you good practice in any technology you want to learn and use.

MySQL is open source and can be downloaded for free. If you have a Linux machine or partition (I will explain what a partition is, later, in the chapter on Operating Systems.), you can run it. IMHO, you don’t need to go that far with database to be a  cyber security researcher.  But, you have to have some understanding of a what a database is and; you do need to know how to access a database and extract information.

Oracle also has a free version to download.

SQL injection. There is a way, using the input fields on a web page, to “inject” SQL statements into the requests submitted from web pages. So, instead of just trying to submit your email address or find out if this shirt comes in the color blue; you can gain access to the system, information and alter critical data. This is an important and common vulnerability and exploit. This is something that every web page with database capabilities, needs to be checked. This is something a cyber security researcher needs to know.

SQL injection attacks require knowledge of SQL. But, basic knowledge should be sufficient.

I will discuss SQL injection attacks and defenses, in detail, in the chapter on web browsers.

This is a good time to give an example of a “script kiddie” vs. a knowledgeable hacker. One can get a tool–a Firefox plugin, like “SQL Inject Me” and make all sorts of SQL injection attacks. You may or may not know what the attacks are or; more importantly, you may not know how to exploit them. But you can test a website and come up with lots of errors or no errors. Viola! You are a script kiddie. If however, you can write the attacks yourself and/or understand the attacks, then, you are a knowledgeable hacker. One avenue, is to take the tool, and study its attacks and figure out what they do and how to exploit them. Up your game.

Java – If you want to program Android apps, you need to know Java.

“The Java Programming Language” by James Gossling, is the Java bible. James Gossling made the Java language. I recommend this book only as a reference guide. Not as a study guide to learn Java. To learn Java, I would recommend more “Java For Dummies”.

PHP – An exceedingly popular scripting language. Usually used in the “LAMP” combination. Linux, Appache, MySql, PHP. All this software is free. A reason why it is so popular, I assume.

PHP is a scripting language like Javascript. There are differences. Javascript is client side. That means, it works on your computer and you can see everything it does. You see the Javascript code. PHP is server side. That means, the server creates a web page and shows you the web page on your machine. The code is hidden. Also, the PHP processor can work with, collect and save the information you submit.

W3Schools does have a course on PHP. It is worth taking. But, it is not enough. You will need more to know more. There is a PHP For Dummies. I can’t say how good it is.

PHP is shareware. So, you can download it. Install it and run it on your machine. Then, make test PHP pages.

While I don’t think you need to be able to write web pages in PHP, to be a cyber researcher; PHP does have a lot of security features. Those features should be turned on. Something a cyber security researcher should check for.

Also, a web page written in PHP is vulnerable to SQL injection.

IMHO, if you really wanted to learn PHP, you should get LAMP (Linux, Appache, MySQL, PHP) running and make some web pages. You need to use PHP in context—on a server and as a served web page, to learn how to program in PHP.

[This section is not yet written.]

You can’t know everything. You can’t do it all. LAMP is a common and popular specialty for webmasters and system administrators.

[This section is not yet written.]

While it is beyond the scope of this book to give you a course on programming or programming languages, there are some basics, which I would like to impart. Remember I said, ‘Computers are really stupid. But, they can do one thing very fast.’ This brings us to the heart of programming. Loops and if…then logic. That is the heart of all programming.

Loops. There are several kinds of loops or ways to iterate, do things over and over again, in computers. That is what computers are so good at. We can either count up or down, a certain number of times. We do “it” 10 times, from 1 to 10 or; from 10 to 1. Or, we can do something until we have satisfied a condition.

For example, you could work all day in a factory making widgets until 5 PM or; you could make 100 widgets to fill an order. It depends on your needs.

The repetitive work done in a loop is often referred to as a “routine” or “sub-program”. Dividing a program up into “modules” and routines makes the program(s) manageable and clearer for us humans. Good programming is divided into modules.

If…Then Logic. This is the whole basis of computer logic. There are some fancy ways of doing this. But, it all boils down to the same thing. If this, then that. If not this, then we don’t that.

If…Then logic also introduces the concept of branching. You can direct the flow of your program. Remember, what I said about linear programming? Things are done one instruction after another? Branching lets us jump the line, skip instructions and bring another instruction in as the next thing to do. If…then I branch to do…

This can get a bit fancy and complicated. If…Else…Else…Else Also, there is a programming construct in C called a “Case”. If you think about it, it is a nicely worded if…then statement.

Logic. Programming languages need to be used in a logical fashion. This may seem like the stupidest thing you have ever heard! But, as stupid as it sounds, is as necessary as it needs to be said. Programming requires logic. That doesn’t mean people program logically. Therefore, I strongly recommend, that you study the basics of logic.

Logic is a large field of knowledge. Sometimes considered science. Sometimes considered math. Sometimes considered psychology. Sometimes considered philosophy. There are different areas of logic.

What you need to study is the basics of symbolic logic, which includes truth tables. Get a book on discrete mathematics. It should have one chapter devoted to logic. You don’t need a whole logic course on the 13 fallacies and how to debate. You do need to understand some group theory; logical flow and a logical proof.

I can recommend the “Discrete Math/Logic” page on Wikipedia. Just search for “Discrete Math Logic” on www.wikipedia.org Or; go to the following link:

https://en.wikibooks.org/wiki/Discrete_Mathematics/Logic

You need to know what a logical statement is. If … Then — every programming language has an if—then programming construct. Many languages have other additional programming constructs that are similar. Yet, at their heart is the if—then programming construct.

If a Then b.

You need to know what a logical AND, OR, NOT, XOR is.

If both things are true, then A AND B is true.

If both things are not true, then A AND B is false.

If A or B is true, but not both A AND B are true, then A AND B are false.

If one or the other is true, then A OR B is true.

If both things are true, then A OR B is also true. If both are true, at least one is true. Because one is true, the statement is entirely true. We don’t need both to be true. We only need one to be true.  So, A OR B is true. Get it?

If NOT A, then if A is NOT true.  We want anything but A.

If NOT (A AND B), then, when both things are not happening at once, that is the desired situation.

The parenthesis, as in regular math, indicates the grouping together of items.

If NOT (A OR B), then if either one is not happening, that is the situation I am looking for.

The XOR is a more specialized logic that is very necessary for encryption. The ‘X’ stands for exclusive. That means, A XOR B – either A or B, but not both can be true. This is more refined than A OR B. In the case of A OR B, either one or both can be true. With XOR, only one can be true.

This becomes very relevant and essential to binary arithmetic. Which, is very important to encryption.

This reduction of processes and observations into facts, groups of facts, appearing or not; based upon causations or the lack of causations; is logic. This has a lot to do with how we think, analyze, compare and categorize data and facts. This is how we come to conclusions. These are the building blocks of computers of both the physical hardware logic circuit boards and the software programs.

These “statements” can be rendered with symbols for easier reading: symbolic logic.

These statements can also be rendered into Truth Tables.

You may need to make good use of this or similar techniques to figure out what a program is doing.

Flowcharts.

You may need this technique to outline what a program is doing. The programs you are going to reverse engineer are large. You may / should document the program flow. A flowchart is a kind of diagram that shows a logical process and will give you an easily readable summary, documenting the program flow.

There will be times that you may not be able to keep the whole program flow in your head. What you figure out today, you may not remember months from now. A flowchart will help you remember. Also, a flowchart will help you more easily explain to others, what the program is doing.

The 5 basic symbols are the start and end symbol. Both designated by an oval, with the words ‘start’ and ‘stop’ written inside, respectively. A rectangle indicates a process. A diamond indicates a decision. Generally, the program flows in from the top and out the bottom. The right and left vertices indicate ‘true’ or ‘false’. The true / false vertices are labeled ‘T’ or ‘F’ respectively. A small circle indicates the connecting of processes.

[This part not written yet.]

A good, simple brief explanation can be found at the following link:

https://en.wikibooks.org/wiki/The_Computer_Revolution/E_commerce/Flowchart

Use Cases & Object Oriented Programming.

Older, conventional programming is referred to as linear program. This is because the programs have a beginning starting and flow sequentially, more or less, to an end. There can be loops—repeated procedures or processes within the flow. There can also be “branching”–Interrupting the sequential flow to do some side process. But, when the ‘side process’ is complete, “control” is returned to the main program and the sequential flow is continued. Things can get a little more complicated with nested routines calling other routines and the program stopping in the middle of a routine. But, there is a linear, logical flow.

Object Oriented Programming, abbreviated OOP is a different and very popular way of programming. OOP came into vogue in the 1990s.  [To be continued.]