Discover and read the best of Twitter Threads about #Fuzzing
Most recents (7)
☃️OSRE Course☃️
This repository contains a fill blown Offensive Security and Reverse Engineering course and the courses covered include
➡️Reverse Engineering
➡️Bug Hunting and Fuzzing
➡️Intro to Assembly x86 and x64
and much more..
#bugbounty #fuzzing #infosec #cybersecurity
This repository contains a fill blown Offensive Security and Reverse Engineering course and the courses covered include
➡️Reverse Engineering
➡️Bug Hunting and Fuzzing
➡️Intro to Assembly x86 and x64
and much more..
#bugbounty #fuzzing #infosec #cybersecurity
@binaryz0ne That's a wrap!
If you enjoyed this thread:
1. Follow me @thebinarybot for more of these
2. RT the tweet below to share this thread with your audience
If you enjoyed this thread:
1. Follow me @thebinarybot for more of these
2. RT the tweet below to share this thread with your audience
I revisited NahamCon 2021 and found the talk by @rez0__ on fuff super informative.
Hence, I decided to write a thread on it for those who don't have time to watch the talk.
"fuff scripts & tricks" - A thread.
🧵👇
#bugbounty #infosec #fuzzing #bugbountytips #cybersecurity
Hence, I decided to write a thread on it for those who don't have time to watch the talk.
"fuff scripts & tricks" - A thread.
🧵👇
#bugbounty #infosec #fuzzing #bugbountytips #cybersecurity
🚔Obey the law
Before we dive into the tips and tricks, remember that fuff is a powerful tool and don't spam it everywhere. Use the -t or -rate flags wherever necessary.
Before we dive into the tips and tricks, remember that fuff is a powerful tool and don't spam it everywhere. Use the -t or -rate flags wherever necessary.
🔊 1. Noise Reduction
Sharing a project that aims to make fuzzing more accessible:
github.com/thepudds/fzgen
fzgen builds on Go 1.18 fuzzing, adding:
- Fuzz complex types (structs, interfaces, ...)
- Auto gen fuzzing wrappers from normal code
- Auto hunt for concurrency bugs
#fuzzing #golang 1/n
github.com/thepudds/fzgen
fzgen builds on Go 1.18 fuzzing, adding:
- Fuzz complex types (structs, interfaces, ...)
- Auto gen fuzzing wrappers from normal code
- Auto hunt for concurrency bugs
#fuzzing #golang 1/n
Some fun examples...
Fuzzing the syzkaller implementation without writing any code:
github.com/thepudds/fzgen…
2/n
Fuzzing the syzkaller implementation without writing any code:
github.com/thepudds/fzgen…
2/n
[#Fuzzing Evaluation] How do we know which fuzzer finds the largest number of important bugs within a reasonable time in software that we care about?
A commentary on @gamozolabs' perspective.
(Verdict: Strong accept).
A commentary on @gamozolabs' perspective.
(Verdict: Strong accept).
YES! We need to present our plots on a log-x-scale. Why? mboehme.github.io/paper/FSE20.Em…
Two fuzzers. Both achieve the same coverage eventually. Yet, one performs really well at the beginning while the other performs really well in the long run. (What is a reasonable time budget? 🤔)
Two fuzzers. Both achieve the same coverage eventually. Yet, one performs really well at the beginning while the other performs really well in the long run. (What is a reasonable time budget? 🤔)
Nice! I agree, comparing *time-to-same-coverage* provides more information about fuzzer efficiency than comparing coverage-at-a-given-time.
5 years ago I proposed a #golang fuzz-a-thon in honour of the release of 1.5.
Probably a good time to do it again preparing for 1.15
groups.google.com/forum/#!msg/go…
Probably a good time to do it again preparing for 1.15
groups.google.com/forum/#!msg/go…
Come hang out in the #fuzzing channel on the Gophers Slack or ask questions here.
Here's a quick go-fuzz tutorial I wrote:
medium.com/@dgryski/go-fu…
Some defaults in go-fuzz have changed, so once you have your fuzz function you can just run:
go-fuzz-build && go-fuzz
to start finding crashes.
medium.com/@dgryski/go-fu…
Some defaults in go-fuzz have changed, so once you have your fuzz function you can just run:
go-fuzz-build && go-fuzz
to start finding crashes.
LIVE FROM COLUMBIA, IT'S #REALWORLDCRYPTO
First up is the TLS session 🔒
First talk is Johanna Amann on measuring TLS 1.3 deployment in the wild with active and passive methods
#realworldcrypto
#realworldcrypto
Kostya's keynote: LibFuzzer hasn't found new bugs in <big software companie>'s library. We didn't know why. Later we got a note that they are now using LibFuzzer during regression testing in CI and that it prevented 3 vulns from reaching to production.
In Chrome, libFuzzer found 4k bugs and 800 vulns. In OSS-Fuzz, libFuzzer found 2.4k bugs (AFL found 500 bugs) over the last three years.
@kayseesee #fuzzing #shonan
@kayseesee #fuzzing #shonan
@kayseesee Fuzz-driven Development: Write your fuzz targets first.
