Introduction to Browser Fuzzing
•
9 likes•7,712 views
This document discusses fuzzing browsers to uncover security vulnerabilities. It explains that fuzzing involves sending malformed or unexpected input to programs to find crashes or bugs. Specifically for browsers, fuzzing is useful because browsers are commonly targeted and easy to test. Successful fuzzing can find issues like buffer overflows, integer overflows, and out of bound reads. Finding bugs through fuzzing can help secure systems and earn significant rewards through browser bug bounty programs.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Introduction to Browser Fuzzing
Similar to Introduction to Browser Fuzzing (20)
More from n|u - The Open Security Community
More from n|u - The Open Security Community (20)
Recently uploaded
Recently uploaded (20)
Introduction to Browser Fuzzing
- 1. By - Anil Aphale aka 41.w4r10r
- 2. • What ever I am going to discuss in this presentation are my own views about fuzzing. Fuzzing is not unique or dark magic. It is known for years now.
- 3. • What is fuzzing • Why Fuzzing • Why Fuzz Browsers • How To Fuzz Browser • What Is Outcome
- 4. • Sort of Laziness • Stress Testing • Penetration Testing • Evilness with good coding • Bad Inputs for good Output
- 5. • To uncover security bugs • For Securing our self (also others in some cases) • Checking Robustness of the product • Find bugs before some one exploit you
- 6. $$$
- 7. • Weakest Entry Point for any Internet Connected Computer/Laptop • Its fun to see some good codes doing bad stuff then the bad files doing bad stuff. • Browsers are easy to understand as we use it everyday • No special configuration required on computer
- 8. • You have multiple targets • Currently it is hot in the market
- 9. • Learn JavaScript Programming with bad logic • Create Good Codes Doing Bad Stuff • Create Fuzzer and launch it against targeted browser • Static Fuzzer(Mutation Based Fuzzing) & Dynamic Fuzzer
- 10. • Collect various templates • Create multiple mutations for each templates for increasing test cases • Need to Load each test case into browser • Time Consuming and resource consuming
- 11. • Browser Fuzzer 3 (bf3) is a comprehensive web browser fuzzer that fuzzes CSS, DOM, HTML and JavaScript developed by Jeremy Brown. • Good Tutorial with example by Abyssec http://www.abysssec.com/blog/2009/08/21/how-to-write- browser-fuzzer/
- 12. • Dynamic Fuzzer creates test cases inside browsers • Require less resources • Less attention required • Few files together do great work
- 13. • Grinder Developed By Stephen Fewer • JsFunFuzz Developed By Jesse Ruderman • Cross_Fuzz By Michal Zalewski
- 14. • Buffer Overflows • Integer Overflow • Use After Free • Heap Overflow • Out Of Bound Read
- 15. $$$
- 16. • Pinkie Pie Won $60000x2 times in pwnium • Pwn2Own • Google Chromium/Mozilla Firefox Bug Bounties • Zero Day Initiative • IDefense • Exodus Intelligence
- 18. • Find Me @ 41.w4r10r@gmail.com OR www.garage4hackers.com OR Twitter : @41w4r10r