Introduction to Browser Fuzzing

8,514 views

Published on

null Banglore Chapter - December 2012 Meet

Published in: Education
0 Comments
7 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
8,514
On SlideShare
0
From Embeds
0
Number of Embeds
534
Actions
Shares
0
Downloads
0
Comments
0
Likes
7
Embeds 0
No embeds

No notes for slide

Introduction to Browser Fuzzing

  1. 1. By -Anil Aphale aka 41.w4r10r
  2. 2. • What ever I am going to discuss in this presentation are my own views about fuzzing. Fuzzing is not unique or dark magic. It is known for years now.
  3. 3. • What is fuzzing• Why Fuzzing• Why Fuzz Browsers• How To Fuzz Browser• What Is Outcome
  4. 4. • Sort of Laziness• Stress Testing• Penetration Testing• Evilness with good coding• Bad Inputs for good Output 
  5. 5. • To uncover security bugs• For Securing our self (also others in some cases)• Checking Robustness of the product• Find bugs before some one exploit you
  6. 6. $$$
  7. 7. • Weakest Entry Point for any Internet Connected Computer/Laptop• Its fun to see some good codes doing bad stuff then the bad files doing bad stuff.• Browsers are easy to understand as we use it everyday• No special configuration required on computer
  8. 8. • You have multiple targets• Currently it is hot in the market
  9. 9. • Learn JavaScript Programming with bad logic• Create Good Codes Doing Bad Stuff• Create Fuzzer and launch it against targeted browser• Static Fuzzer(Mutation Based Fuzzing) & Dynamic Fuzzer
  10. 10. • Collect various templates• Create multiple mutations for each templates for increasing test cases• Need to Load each test case into browser• Time Consuming and resource consuming
  11. 11. • Browser Fuzzer 3 (bf3) is a comprehensive web browser fuzzer that fuzzes CSS, DOM, HTML and JavaScript developed by Jeremy Brown.• Good Tutorial with example by Abyssechttp://www.abysssec.com/blog/2009/08/21/how-to-write-browser-fuzzer/
  12. 12. • Dynamic Fuzzer creates test cases inside browsers• Require less resources• Less attention required• Few files together do great work
  13. 13. • Grinder Developed By Stephen Fewer• JsFunFuzz Developed By Jesse Ruderman• Cross_Fuzz By Michal Zalewski
  14. 14. • Buffer Overflows• Integer Overflow• Use After Free• Heap Overflow• Out Of Bound Read
  15. 15. $$$
  16. 16. • Pinkie Pie Won $60000x2 times in pwnium• Pwn2Own• Google Chromium/Mozilla Firefox Bug Bounties• Zero Day Initiative• IDefense• Exodus Intelligence
  17. 17. • Find Me @ 41.w4r10r@gmail.com OR www.garage4hackers.com OR Twitter : @41w4r10r

×