Fuzzing

1,098 views

Published on

Patryk Branicki, Radosław Matusiak - FuzzMyApp - Fuzzing

Published in: Technology, Education
  • Be the first to comment

Fuzzing

  1. 1. FuzzMyApp FuzzMyApp 2013
  2. 2. Kim jeste my Patryk Branicki Rados roscoe network security reverse engineering malware analysis penetrationtesting vulnerability research fuzzing :-) 2011/2012 startup FuzzMyApp FuzzMyApp 2013
  3. 3. Fuzzing - FuzzMyApp 2013 Fuzz testing or fuzzing is a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer program.
  4. 4. Fuzzing - Cele Proces wytwarzania oprogramowania Testy warunków brzegowych, eksploracja - Exploiting (black / white hat) Offensive GOV -> USA, Izrael vs Iran (Struxnet); Niemcy R2D2 trojan etc black market) Avast Responsible disclosure (1337 fame ?) FuzzMyApp 2013
  5. 5. Fuzzing - FuzzMyApp 2013
  6. 6. Fuzzing - Eksploracja FUZZ FuzzMyApp 2013
  7. 7. Microsoft SDL FuzzMyApp 2013
  8. 8. Czy: MP3 AVI BMP / PNG / JPG Open port (socket) Web Service Czy MP3 odtwarzane w Winampie FuzzMyApp 2013
  9. 9. FuzzMyApp 2013
  10. 10. Fuzzing @Microsoft SDL MiniFuzz SDL Regex Fuzzer Distributed Fuzzing Framework SETI@home fuzzing botnet miliony iteracji FuzzMyApp 2013
  11. 11. Fuzzing @Google DOM fuzzer PDF (Adobe Reader) ) Fuzzing produktow (Chrome) oraz produktow innych firm (Adobe) FuzzMyApp 2013
  12. 12. Programy g hunting - Google FuzzMyApp 2013
  13. 13. Fuzzing @Adobe FuzzMyApp 2013
  14. 14. www.cvedetails.com/vendor/53/ Adobe.html FuzzMyApp 2013
  15. 15. http://www.cvedetails.com FuzzMyApp 2013
  16. 16. www.cvedetails.com/product/398/ Symantec-NortonAntivirus.html? vendor_id=76 FuzzMyApp 2013
  17. 17. java-0day.com FuzzMyApp 2013
  18. 18. Co ? API Drivery FuzzMyApp 2013
  19. 19. IrfanView,XnView (formaty graficzne) Winamp,foobar(formaty audio) Realtek (konfiguracja) Opera (SVG) Oracle (Java) JOAL(API) Microsoft(Explorer) Apple (formaty multimedialne) CISCO WebEx (nagrane prezentacje) CISCO CUPC (komunikacja) Adobe Reader,Foxit FuzzMyApp 2013
  20. 20. Java OpenAL (JOGAMP) OpenAL (ang. Open Audio Library) to specyfikacja CVE-2013-4099 (FMA-2012-038) 69 b Remote Code Execution FuzzMyApp 2013
  21. 21. Jak to robimy? fuzzerów hanging fruit) Automatyzacja Research Research ! Research !! FuzzMyApp 2013
  22. 22. Technologia JS web browser / DOM fuzzers Java Java fuzzer C / C++ Python idealny do pisania fuzzerów Dobrana pod zadanie! FuzzMyApp 2013
  23. 23. Problemy Know-how Prawdziwe know- Code coverage, exploracja FuzzMyApp 2013
  24. 24. Pytania? FuzzMyApp 2013

×