Debuggers are a tool in cybersecurity for software development, and they provide a way to analyze and
understand the internal workings of a program.
What this means is we're identifying different bugs or analyzing crashes to investigate security vulnerabilities
within our programs.
This allows us to go through and identify and understand why exactly a program is acting the way it
does.
If you've ever played a video game or had a program that you've utilized on a day to day basis suddenly
crash or provide you with an error code, you'll be kind of like, ah, that sucks, and you move on
with your life.
But as a software developer or as from a security perspective, you need to understand that those errors
and those crashes pose a significant risk to our overall system and those vulnerabilities that it creates,
or those injection of error codes allow for attackers to understand and exfiltrate different aspects
of the code.
This can lead for them to understand the different vulnerabilities and then the flaws within the program,
which then could allow them to attack or exploit those vulnerabilities.
Making a debugging an essential part of cybersecurity.
The first debugger I want to talk about is Immunity and is designed for the security industry, which
allows a dynamic code analysis of the different applications.
Now we've talked about dynamic code analysis versus static code analysis.
And if you can't remember, dynamic code analysis is letting the program run and then identifying or
tracking what it does while it goes through the program.
The same aspect is within dynamic debuggers is they let the code run, and we can identify vulnerabilities
to better understand the potential exploitations that an attacker may utilize.
Immunity is known for tracking and identifying the different manipulation factors within the registrars
the memory, the stock frames, and it enables an in-depth exploration of the application's internal
workings.
What this means is, is that it can look at the registers or the stack and identify, hey, is this
program doing what it's supposed to be doing?
And when it crashes, is it providing a vulnerability for someone to take advantage of the program itself?
This can lead to vulnerabilities within the password or the encryption keys.
And what we're really doing is we're looking for what is the programming do when it bugs out, does
it form properly?
If it does crash, is it handling that crash properly?
If it's not, that can open up problems for the for the program as a whole.
And immunity debugger works to identify those specific problems within the within the program.
So what that means is, is that it's looking for the different bugs within the program or the different
vulnerabilities.
And when it detects the error, is it handling that error correctly.
The next code we want to talk about or the next program I want to talk about is GNU debugger or GDB.
This open source tool is utilized for, again, dynamic analysis and allows for the setting of breakpoints
or to closely scrutinize the program execution that goes through.
It provides a step by step process of going through the code, monitoring memory changes, and inspecting
the register values.
This allows you, as the analyst, to uncover potential software vulnerabilities, and it does memory
inspection capabilities, particularly with valuable, uh, memory corruption, and it identifies other
security risks.
GDB is really kind of instrumental for us as security analysts to identify specific crashes and why
it's crashing, what's happening with the memory?
If it is a memory issue, how can we fix that issue?
And it really kind of provides a different layer or a different kind of debugging methodology.
Even though they're both dynamic, they search for different aspects of the code.
This type of debugger is usually used to identify specific memory traits.
And again, it's a dynamic code analysis.