Introduction to V8 JavaScript Engine Grammar-based Fuzzing

Introduction to V8 JavaScript Engine Grammar-based Fuzzing

Introduction to V8 JavaScript Engine Grammar-based Fuzzing with Dharma In this short hands-on workshop, we will attack the V8 JavaScript Engine using grammar-based fuzzing. First, I will show how to download a version of V8 already compiled with addressSanitizer (ASAN). Then, I will introduce how to write a Dharma grammar and finally, we will use…

Introduction to JavaScript Fuzzing

Introduction to JavaScript Fuzzing

Introduction to JavaScript Fuzzing​ 1. JavaScript Fuzzing of npm/nodejs/code (omggif) using jsfuzz In this course, I will fuzz a JavaScript npm/nodejs library (omggif) in order to find uncaught JavaScript exceptions. I will explain how to create a fuzzing harness for this target, run the fuzzer (jsfuzz), handle expected exceptions, analyze a crash and create a…

Fuzzing npm/nodejs WebAssembly parsing library with jsfuzz

Fuzzing npm/nodejs WebAssembly parsing library with jsfuzz

Fuzzing javascript nodejs/npm WebAssembly parsing library with jsfuzz I asked recently on twitter what should be my next blogpost subject and voters choose this one, so here it is. In this short blogpost, I will first introduce jsfuzz, a coverage-guided javascript fuzzer for nodejs/npm packages. Then, I’ll discuss about the wasm binary parsing library I…

Fuzzing JavaScript WebAssembly APIs using Dharma/Domato (Chrome/v8)

Fuzzing JavaScript WebAssembly APIs using Dharma/Domato (Chrome/v8)

Fuzzing JavaScript WebAssembly APIs using Dharma/Domato (V8 engine) First of all, Happy new hacking year everyone 😉 I got asked multiple time if fuzzing WebAssembly APIs of Javascript engines is complicated, so here is a short tutorial using Dharma (but you can use Domato if you prefer). In this blogpost, I will first detailed which WebAssembly…

How to create a valid polyglot HTML/JS/WebAssembly module

How to create a valid polyglot HTML/JS/WebAssembly module

How to create polyglot HTML/JS/WebAssembly module Just a bit of context first, so last month I was at the hack.lu conference to give a workshop about “Reversing WebAssembly module 101” and spend some amazing time with friends. Workshop goes well, attendees were really interested and even better I received the award of the best talk/workshop…