Binary Exploitation Toolkit

Ghidra

Ghidra is a free, open-source software reverse engineering (SRE) framework developed by the NSA, released in 2019. It enables security professionals and malware analysts to disassemble, decompile, and analyze compiled code such as malware or binary files without running them. It is available on GitHub.

It can also be installed via apt package manager on various linux distributions. On Kali it can be insalled with sudo apt install ghidra.

Resouces

1. Ghidra PY. A python ghira file that automated ghidra launching steps for you.

GDB Debuggers

GDB (GNU Debugger) is a powerful, open-source command-line tool used to debug programs written in C, C++, Go, and other compiled languages on Unix-like systems. It allows developers to monitor, control, and analyze the execution of a program, making it essential for detecting crashes, inspecting memory, and fixing bug.

1. PWNDBG is a GDB and LLDB plug-in that makes debugging suck less.
2. Peda - Python Exploit Development Assistance for GDB.
3. GEF is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB.

Resources

1. Post by Infosec, Setting up Debuggers

Binary Analysis

CheckSec

Checksec is a widely used tool, originally a bash script by Tobias Klein, designed to quickly check the security properties and mitigation technologies of Linux executables (e.g., PIE, RELRO, Canaries, ASLR, Fortify Source) and the kernel.

# APT
sudo apt install checksec

# DNF
sudo dnf install checksec

Ropper

Ropper is a powerful, Python-based command-line tool used in cybersecurity for binary analysis and finding Return-Oriented Programming (ROP) gadgets.