mozilla nss BigSig buffer overflow google project zero

WHY fuzzers MISSED this buffer-overflow in Mozilla NSS library? 🤦‍♂️ (CVE-2021-43527 explained)

ByPatrick Ventuzelo

Analysis of Mozilla NSS BigSig Vulnerability & Fuzzing issues(CVE-2021-43527) Today I will like to discuss the Mozilla NSS BigSig vulnerability found recently by @taviso from Google Project Zero. Inside its blogpost, Tavis Ormandy detailed the vulnerability and mentioned some really good points about why this bug was not found using fuzzing by OSS-fuzz. It’s a…

scapy protocol fuzzing fuzz testing python
| |

Fuzzing with Scapy: Introduction to Protocol Fuzzing (DNS & TCP packets)

ByPatrick Ventuzelo

Fuzzing with Scapy: Introduction to Network Protocol Fuzzing  In this video, I’m showing how to use Scapy python for network protocol fuzzing. We will first start with a DNS python fuzzing script against dpkt python library. Finally, we will see how what a crash looks like since dpkt will generate an exception after TCP fuzzing. https://youtu.be/yrmPRYSEdg0 You will get access of…

fuzzing chrome browser fuzz testing dom grammar based fuzzing freedom dharma firefox
| |

Fuzzing Browsers DOM using FreeDom grammar-based fuzzer

ByPatrick Ventuzelo

Fuzzing Browsers DOM using FreeDom grammar-based fuzzer In this video, I will first explain how to download Chrome ASAN build. Then, I’ll detail what is DOM (Document Object Model) and how it is used by web browsers. I’ll use the FreeDom grammar-based fuzzer to generate some HTML files and create a simple script to process…

fuzzing firefox browser in-process fuzz testing frida hook
| |

Fuzzing Firefox using In-process Fuzzing with Frida

ByPatrick Ventuzelo

Fuzzing Firefox using In-process Fuzzing with Frida As asked by a lot of you, today’s blogpost is about browser security. First I will show how to download easily Firefox compiled with AddressSanitizer (ASAN). Then, I will show how to use Frida to list all modules and exports of Firefox. I will show some other interesting…

hacking books fuzzing learn hacking
|

Learning Hacking & Fuzzing books ressources​

ByPatrick Ventuzelo

Top 4 books to learn about Fuzz Testing & Vulnerability Research in 2022 Today, I will like to show you my TOP 4 Hacking Books to Start learning Fuzzing and Vulnerability Research. Fuzzing: Brute Force Vulnerability Discovery – link Fuzzing for Software Security Testing and Quality Assurance – link A Bug Hunter’s Diary – link…

javascript fuzzing fuzz testing js jsfuzz

Introduction to JavaScript Fuzzing

ByPatrick Ventuzelo

Introduction to JavaScript Fuzzing​ 1. JavaScript Fuzzing of npm/nodejs/code (omggif) using jsfuzz In this course, I will fuzz a JavaScript npm/nodejs library (omggif) in order to find uncaught JavaScript exceptions. I will explain how to create a fuzzing harness for this target, run the fuzzer (jsfuzz), handle expected exceptions, analyze a crash and create a…

fuzzing java code jazzer code intelligence oss fuzz fuzzing patrick ventuzelo fuzzinglabs jql
| |

Fuzzing Java code using Jazzer

ByPatrick Ventuzelo

Fuzzing Java code using Jazzer Java Fuzzer Fuzzing Java code (JSoup) using Jazzer fuzzer In this course, I will fuzz a popular Java library (JSoup) in order to find uncaught Java exception. I will explain how to create a java fuzzing harness for this target using the Jazzer java fuzzer. Then, I will run it and show you what’s happening when…

fuzzing c cplusplus c++ program code honggfuzz afl patrick ventuzelo fuzzinglabs fuzz testing

Fuzzing C/C++ program using honggfuzz

ByPatrick Ventuzelo

Fuzzing C code / C++ programs using honggfuzz Tutorial In this tutorial, I will show how you can start fuzzing C code and C++ programs (binutils/readelf) very easily using honggfuzz. I will first compile honggfuzz and briefly explain the main mechanism behind it. Then, I will compile the targeted program (binutils / readelf) using the honggfuzz compilers. Finally,…

fuzzing labs golang go gofuzz go-fuzz fuzz testing code package library
| |

Introduction to Fuzzing Golang

ByPatrick Ventuzelo

Introduction to Fuzzing Golang code 1. Fuzzing Go package using go-fuzz & libfuzzer In this course, I will first select a popular Golang library and identify the most interesting methods to fuzz. Then, I’ll explains how to use go-fuzz and libfuzzer to compile the fuzzing target. Finally, I’ll show how to run the fuzzer.https://www.youtube.com/watch?v=EsSebOAD5yw&list=PLa-iO6ehPFJgCKKiyEU__dUJVDVh-TUbT 2….