Go Security Audit and Fuzzing
Go (golang) is a statically typed and compiled programming language designed by Google. Over the years, it has become a language of choice for developers to build concurrency backend applications while maintaining high performance at scale.
This course teaches you all the prerequisites to understand which kind of vulnerability can be found inside Go code. You will learn how to find low-hanging fruits bugs manually and automatically using different Go auditing tools. You will discover how to use existing Go fuzzing coverage-guided frameworks, triage/debug crashes, and improve your code coverage. Finally, you will discover how to build custom Go fuzzers and implement advanced fuzzing techniques to find in-depth bugs on popular Go packages.
Along this training, students will deal with a lot of hands-on exercises allowing them to internalize concepts and techniques taught in class.
Day 1 - Go Security Audit and Code Review
In this course, you will focus on learning Go code audit and vulnerability research. First, You will discover the internal of Go and which security mechanisms are enforced by default. Then, you will learn which vulnerabilities are the most common and how to find low-hanging fruits bugs manually and automatically using different Go auditing tools.
- Introduction to Go
- Golang Ecosystem
- Security concepts
- Concurrency, Garbage collector, etc.
- Golang common vulnerabilities
- Panicking function
- Arithmetic errors
- Out-of-bounds panics
- SIGSEGV / Nil pointer dereference
- Resource exhaustion / OOM, Stack overflow
- Advanced vulnerabilities
- Unsafe code
- Data races, Race conditions,
- Memory Leak, Logic errors
- Concurrency issues (Deadlock, Goroutine leak, etc.)
- Web Application Vulnerabilities (SQLI, XSS, etc.)
- Attack surface discovery
- Auditing tools
- Exercises
Day 2 - Go Fuzzing and Crash Analysis
In this course, you will discover how to use existing Go fuzzing coverage-guided frameworks, triage/debug crashes, and improve your code coverage. Finally, you will discover how to build custom Go fuzzers and implement advanced fuzzing techniques to find in-depth bugs on popular Go packages.
Along with this training, students will deal with a lot of hands-on exercises allowing them to internalize concepts and techniques taught in class.
- Introduction to Fuzzing
- Coverage-guided Fuzzing
- go-fuzz / libfuzzer
- Go Fuzz testing workflow and Corpus selection
- Code coverage, Corpus minimization
- Crashes Triaging and Debugging
- Other Advanced Fuzz Testing techniques
- Differential Go Fuzzing
- Writing Custom Go Fuzzers
CLASS REQUIREMENTS
Participants should have some basis with the Go language and Linux. This course is suitable for people that are new to Go. All the theory and concepts about Go security vulnerability research and Go fuzz testing will be explained during the course.
Hardware Requirements
A working laptop capable of running virtual machines. 4GB RAM required, at a minimum. 40 GB free Hard disk space. Minimum software to install Virtualbox or VMware Player, VMware Workstation, VMware Fusion.