Security Testing: Fuzzing
•Download as PPTX, PDF•
1 like•2,972 views
The presentation was given at Seattle CodeCamp 2012 and covers Fuzz Testing. Provides details on what is Fuzzing, why Fuzzing is so effective and how to Fuzz Test your application.
Report
Share
Report
Share
Recommended
AFLGo: Directed Greybox Fuzzing
This document summarizes a PhD thesis defense presentation on directed greybox fuzzing. It discusses:
1. Different types of fuzzing techniques including blackbox, whitebox, and greybox fuzzing.
2. How directed greybox fuzzing formulates the problem of reaching targeted locations as an optimization problem rather than using heavy symbolic execution.
3. The instrumentation process to compute distance metrics to target locations and guide input generation towards minimizing distance.
Google mock for dummies
GoogleMock is a framework for creating mock objects in C++. Mock objects implement the same interfaces as real objects but allow specifying expectations for method calls. There are three main steps to using GoogleMock: 1) define a mock class using macros, 2) create mock objects and specify expectations, and 3) exercise code using mocks and check expectations are met. Key features include setting expected call order, arguments, return values, and catching violations. Mocks isolate code from complex dependencies and allow focused testing.
An introduction to Google test framework
This document provides an introduction to using the Google Test framework for unit testing C++ code. It begins with an example of a simple test for a function called calc_isect. It then demonstrates how to add assertions to tests, use test fixtures to reduce duplicated setup code, and generate parameterized tests. The document also covers best practices for test organization, installing and using Google Test, and some key features like XML output and selecting subsets of tests. Overall, the document serves as a tutorial for getting started with the Google Test framework for writing and running unit tests in C++ projects.
Unit Testing Concepts and Best Practices
Unit testing involves writing code to test individual units or components of an application to ensure they perform as expected. The document discusses best practices for unit testing including writing atomic, consistent, self-descriptive tests with clear assertions. Tests should be separated by business module and type and not include conditional logic, loops, or exception handling. Production code should be isolated from test code. The goal of unit testing is to validate that code meets specifications and prevents regressions over time.
An Introduction to Unit Testing
Unit testing involves testing individual components of software to ensure they function as intended when isolated from the full system. It helps identify unintended effects of code changes. While unit tests cannot prove the absence of errors, they act as an executable specification for code behavior. Writing unit tests requires designing code for testability through principles like single responsibility and dependency injection. Tests should focus on public interfaces and state transitions, not implementation details. Test-driven development involves writing tests before code to define requirements and ensure only testable code is written. Mocking frameworks simulate dependencies to isolate the system under test. Well-written unit tests keep behaviors isolated, self-contained, and use the arrange-act-assert structure.
Unit Testing And Mocking
This document provides an introduction to unit testing and mocking. It discusses the benefits of unit testing such as safer refactoring and value that increases over time. It provides a recipe for setting up a unit test project with test classes and methods using AAA syntax. It also covers what mocking is and how to use mocking frameworks to create fake dependencies and check interactions. Resources for learning more about unit testing and related tools are provided.
Unit and integration Testing
This document discusses unit and integration testing. It begins by explaining the benefits of testing, such as reducing bugs and allowing safe refactoring. It then describes different types of tests like unit, integration, and database tests. The document focuses on unit testing, explaining how to write and organize unit tests using PHPUnit. It provides examples of test assertions and annotations. It also covers mocking and stubbing dependencies. Finally, it discusses challenges like testing code that relies on external components and provides strategies for database testing.
Windows kernel basic exploit
Windows Kernel basic exploit technic && Windows Kernel basic hooking technic
presented at SSG 000 open seminar
2017.08
Recommended
AFLGo: Directed Greybox Fuzzing
This document summarizes a PhD thesis defense presentation on directed greybox fuzzing. It discusses:
1. Different types of fuzzing techniques including blackbox, whitebox, and greybox fuzzing.
2. How directed greybox fuzzing formulates the problem of reaching targeted locations as an optimization problem rather than using heavy symbolic execution.
3. The instrumentation process to compute distance metrics to target locations and guide input generation towards minimizing distance.
Google mock for dummies
GoogleMock is a framework for creating mock objects in C++. Mock objects implement the same interfaces as real objects but allow specifying expectations for method calls. There are three main steps to using GoogleMock: 1) define a mock class using macros, 2) create mock objects and specify expectations, and 3) exercise code using mocks and check expectations are met. Key features include setting expected call order, arguments, return values, and catching violations. Mocks isolate code from complex dependencies and allow focused testing.
An introduction to Google test framework
This document provides an introduction to using the Google Test framework for unit testing C++ code. It begins with an example of a simple test for a function called calc_isect. It then demonstrates how to add assertions to tests, use test fixtures to reduce duplicated setup code, and generate parameterized tests. The document also covers best practices for test organization, installing and using Google Test, and some key features like XML output and selecting subsets of tests. Overall, the document serves as a tutorial for getting started with the Google Test framework for writing and running unit tests in C++ projects.
Unit Testing Concepts and Best Practices
Unit testing involves writing code to test individual units or components of an application to ensure they perform as expected. The document discusses best practices for unit testing including writing atomic, consistent, self-descriptive tests with clear assertions. Tests should be separated by business module and type and not include conditional logic, loops, or exception handling. Production code should be isolated from test code. The goal of unit testing is to validate that code meets specifications and prevents regressions over time.
An Introduction to Unit Testing
Unit testing involves testing individual components of software to ensure they function as intended when isolated from the full system. It helps identify unintended effects of code changes. While unit tests cannot prove the absence of errors, they act as an executable specification for code behavior. Writing unit tests requires designing code for testability through principles like single responsibility and dependency injection. Tests should focus on public interfaces and state transitions, not implementation details. Test-driven development involves writing tests before code to define requirements and ensure only testable code is written. Mocking frameworks simulate dependencies to isolate the system under test. Well-written unit tests keep behaviors isolated, self-contained, and use the arrange-act-assert structure.
Unit Testing And Mocking
This document provides an introduction to unit testing and mocking. It discusses the benefits of unit testing such as safer refactoring and value that increases over time. It provides a recipe for setting up a unit test project with test classes and methods using AAA syntax. It also covers what mocking is and how to use mocking frameworks to create fake dependencies and check interactions. Resources for learning more about unit testing and related tools are provided.
Unit and integration Testing
This document discusses unit and integration testing. It begins by explaining the benefits of testing, such as reducing bugs and allowing safe refactoring. It then describes different types of tests like unit, integration, and database tests. The document focuses on unit testing, explaining how to write and organize unit tests using PHPUnit. It provides examples of test assertions and annotations. It also covers mocking and stubbing dependencies. Finally, it discusses challenges like testing code that relies on external components and provides strategies for database testing.
Windows kernel basic exploit
Windows Kernel basic exploit technic && Windows Kernel basic hooking technic
presented at SSG 000 open seminar
2017.08
Test Driven Development
What is TTD?
Unit Test & Refactoring
Got Bugs?
Tenets of TTD.
Benifits of TDD.
Advantages & Disadvantages of TDD.
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
Although web application firewall (WAF) solutions are very useful to prevent common or automated attacks, most of them are based on blacklist approaches and are still far from perfect. This talk illustrates a number of creative techniques to smuggle and reshape HTTP requests using the strange behaviour of web servers and features such as request encoding or HTTP pipelining. These methods can come in handy when testing a website behind a WAF and can help penetration testers and bug bounty hunters to avoid drama and pain! Knowing these techniques is also beneficial for the defence team in order to design appropriate mitigation techniques. Additionally, it shows why developers should not solely rely on WAFs as the defence mechanism.
Finally, an open source Burp Suite extension will be introduced that can be used to assess or bypass a WAF solution using some of the techniques discussed in this talk. The plan is to keep improving this extension with the help of the http.ninja project.
Load Testing and JMeter Presentation
Load testing simulates multiple users accessing an application simultaneously to evaluate performance under different load scenarios. There are three main types of load testing:
1. Performance testing gradually increases load to determine the maximum number of users/requests per second an application can handle.
2. Stress testing pushes load beyond normal limits to identify the breaking point and ensure error handling.
3. Soak testing subjects an application to high load over an extended period to check for resource allocation problems, memory leaks, and server overloading.
The tool JMeter is commonly used for load testing and allows simulating many users and transactions. It can test HTTP, databases, and other components. Plugins extend its functionality and distributed testing improves load
Level Up! - Practical Windows Privilege Escalation
This document provides an overview of practical Windows privilege escalation techniques. It begins with introductions and disclaimers, then discusses Windows access control models and concepts like integrity levels. It proceeds to demonstrate potential escalation avenues like exploiting privileged access elsewhere on the network, extracting credentials from files, exploiting unpatched vulnerabilities, weak permissions on services/files, AlwaysInstallElevated policies, and DLL hijacking. The document emphasizes that privilege escalation is still possible even with UAC and provides tools and references for further information.
05 junit
This document discusses test-driven development and unit testing with JUnit. It covers:
- Writing tests before code using stubs, so code is testable and requirements are clear.
- Key aspects of JUnit like test classes, fixtures, assertions and annotations like @Before, @Test.
- Best practices like testing individual methods, writing simple tests first, and repeating the test-code cycle until all tests pass.
- Features of JUnit in Eclipse like generating test stubs from code and viewing test results.
The overall message is that testing saves significant time versus debugging, helps write better code, and is an essential part of the development process. Tests should cover all requirements and edge cases to
Testing in go
Tests are extremely importante in software development. This talk bring a quick introduction to the art of testing in Go, given a special focus on the standard lib, but also giving a quick glance at other alternatives.
Unit testing
Unit testing involves testing individual units or components of code to ensure they work as intended. It focuses on testing functional correctness, error handling, and input/output values. The main benefits are faster debugging, easier integration testing, and living documentation. Guidelines for effective unit testing include writing automated, independent, focused tests that cover boundaries and are easy to run and maintain.
Best Practices for Applications Performance Testing
The document outlines best practices and tips for application performance testing. It discusses defining test plans that include load testing, stress testing, and other types of performance testing. Key best practices include testing early and often using an iterative approach, taking a DevOps approach where development and operations work as a team, considering the user experience, understanding different types of performance tests, building a complete performance model, and including performance testing in unit tests. The document also provides tips to avoid such as not allowing enough time and using a QA system that differs from production.
Hang fire
Hangfire is a library for .NET and .NET Core applications that allows easy enqueuing and processing of background jobs such as fire-and-forget, delayed, and recurring jobs without the need for a Windows service or separate process. It provides a unified programming model for handling background tasks in a reliable way and supports short, long, CPU-intensive, and I/O-intensive jobs. Hangfire is available as a NuGet package and supports scenarios such as fire-and-forget jobs, delayed jobs, recurring jobs, continuations, batches, and background processes.
Google test training
The document discusses Google Test, an open source unit testing framework for C++ that can also be used for testing C code, providing an overview of its features and how to implement unit tests using common patterns like test fixtures, assertions, and death tests to validate expected failures. It also covers best practices for writing effective unit tests, including keeping tests independent, focused, and fast-running.
seven-ways-to-run-flink-on-aws.pdf
This document provides an overview of Apache Flink and different ways to deploy Flink applications on cloud platforms. It discusses deploying Flink on EMR, EC2, ECS, EKS, Kinesis Data Analytics for Java, and Lambda. It recommends EMR, discusses advantages like managed Hadoop clusters, and disadvantages like needing to manage the cluster. It also provides an overview of Flink architecture, components like the JobManager and TaskManager, and the data flow API.
In the DOM, no one will hear you scream
The document discusses the history and development of the Document Object Model (DOM) from its early implementations in 1995 to modern standards. It outlines key milestones like DOM Level 1 in 1998, the rise of JavaScript frameworks like Prototype, jQuery and MooTools in 2005-2006, and ongoing work by the W3C and WHATWG. The talk will explore security issues that can arise from the DOM's ability to convert strings to executable code and demonstrate an attack technique called DOM clobbering.
ZIO Queue
At the heart of data processing, event-sourcing, actors, and much more is the queue—a data structure that allows producers to pass work to consumers in a flexible way. On the JVM, most libraries, including Akka, are powered by Java concurrent queues, which are reliable but were designed in a different era, for synchronous (blocking) procedural code. In this presentation, John A. De Goes—architect of the Scalaz 8 effect system—introduces IOQueue, a new type of queue powered by the Scalaz 8 IO monad. IOQueue never blocks and provides seamless, composable back-pressure across an entire application, without users having to think about the problem or write any special code. John will discuss how IOQueue achieves these remarkable properties, and show how the structure can be used to solve hard problems with just a few lines of type-safe, leak-free, composable Scala code. Come learn about the power of Scalaz to solve the hard problems of software development, in a principled way, without compromises.
Inter Process Communication
This document discusses various inter-process communication (IPC) mechanisms in Linux, including pipes, FIFOs, and message queues. Pipes allow one-way communication between related processes, while FIFOs (named pipes) allow communication between unrelated processes through named pipes that persist unlike anonymous pipes. Message queues provide more robust messaging between unrelated processes by allowing messages to be queued until received and optionally retrieved out-of-order or by message type. The document covers the key functions and system calls for creating and using each IPC mechanism in both shell and C programming.
So you think you can write a test case
This document provides guidance on writing effective test cases. It discusses that test cases are documentation that guide testing and serve as a record. Key components of a test case are test steps that provide clear instructions to testers, and expected results that describe how to verify the outcome. The document also outlines best practices like starting test case design after exploring the application, using clear and specific language, and providing supplemental materials like test data sheets to support testing. Maintaining test cases is important as applications evolve, requiring test cases to be revised as needed to continue supporting products.
What's New in v2 - AnsibleFest London 2015
This document discusses version 2 (V2) of Ansible, which refactors portions of Ansible's core executor engine to address technical debt. Key changes in V2 include improved error messages, new block and strategy execution plugins, execution-time evaluation of included tasks, and better object-oriented design. The goal is to improve testability and make it easier to add new features without breaking existing functionality. V2 can be tested now and will become the default in March 2015, while Ansible 1.9 will be the last major release using the original code.
How fun of privilege escalation Red Pill2017
This document discusses various methods for escalating privileges on Windows and Linux systems. It begins by covering remote exploitation of vulnerable services running with high privileges. It then covers other methods such as exploiting weak passwords, insecure file/registry permissions, misconfigured services, and kernel exploits. Specific examples discussed include exploiting sudo permissions, cron jobs, service binary path manipulation, and the DirtyCOW Linux privilege escalation.
Python Deserialization Attacks
Learn how Deserialization tends to vulnerability and which python modules are vulnerable to deserialization attacks.
C++ Unit Test with Google Testing Framework
The slides describe basic features from google test framework and also describe some techniques to make C++ code more testable
Software Testing
This document presents an overview of software testing. It defines software testing as evaluating a program or application under various conditions to check that it meets specifications, functions as intended, and is of high quality. The document outlines objectives of testing like uncovering errors, validating requirements, and generating high-quality test cases. It also defines key terms, describes testing methodologies like black box and white box testing, different testing levels from unit to system, and various types of tests.
Fuzzing
The document discusses fuzz testing or fuzzing, which is a software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program to test for security vulnerabilities or crashes. It provides examples of fuzzing network protocols like HTTP and fuzzing file formats. It also discusses different types of fuzzers and provides an example of vulnerable source code and a simple fuzzing scheme to test it.
Distributed Fuzzing Framework Design
The document discusses distributed fuzzing, which involves spreading the workload of fuzz testing across multiple machines to dig deeper faster. It proposes a distributed fuzzing solution with the following key components: a database to store fuzzing data, a web interface for management, virtual machine nodes running fuzzers and monitoring targets, and an RPC interface to coordinate communication between components. The goal is to make deployment and management of distributed fuzzing easy while avoiding vendor lock-in.
More Related Content
What's hot
Test Driven Development
What is TTD?
Unit Test & Refactoring
Got Bugs?
Tenets of TTD.
Benifits of TDD.
Advantages & Disadvantages of TDD.
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
Although web application firewall (WAF) solutions are very useful to prevent common or automated attacks, most of them are based on blacklist approaches and are still far from perfect. This talk illustrates a number of creative techniques to smuggle and reshape HTTP requests using the strange behaviour of web servers and features such as request encoding or HTTP pipelining. These methods can come in handy when testing a website behind a WAF and can help penetration testers and bug bounty hunters to avoid drama and pain! Knowing these techniques is also beneficial for the defence team in order to design appropriate mitigation techniques. Additionally, it shows why developers should not solely rely on WAFs as the defence mechanism.
Finally, an open source Burp Suite extension will be introduced that can be used to assess or bypass a WAF solution using some of the techniques discussed in this talk. The plan is to keep improving this extension with the help of the http.ninja project.
Load Testing and JMeter Presentation
Load testing simulates multiple users accessing an application simultaneously to evaluate performance under different load scenarios. There are three main types of load testing:
1. Performance testing gradually increases load to determine the maximum number of users/requests per second an application can handle.
2. Stress testing pushes load beyond normal limits to identify the breaking point and ensure error handling.
3. Soak testing subjects an application to high load over an extended period to check for resource allocation problems, memory leaks, and server overloading.
The tool JMeter is commonly used for load testing and allows simulating many users and transactions. It can test HTTP, databases, and other components. Plugins extend its functionality and distributed testing improves load
Level Up! - Practical Windows Privilege Escalation
This document provides an overview of practical Windows privilege escalation techniques. It begins with introductions and disclaimers, then discusses Windows access control models and concepts like integrity levels. It proceeds to demonstrate potential escalation avenues like exploiting privileged access elsewhere on the network, extracting credentials from files, exploiting unpatched vulnerabilities, weak permissions on services/files, AlwaysInstallElevated policies, and DLL hijacking. The document emphasizes that privilege escalation is still possible even with UAC and provides tools and references for further information.
05 junit
This document discusses test-driven development and unit testing with JUnit. It covers:
- Writing tests before code using stubs, so code is testable and requirements are clear.
- Key aspects of JUnit like test classes, fixtures, assertions and annotations like @Before, @Test.
- Best practices like testing individual methods, writing simple tests first, and repeating the test-code cycle until all tests pass.
- Features of JUnit in Eclipse like generating test stubs from code and viewing test results.
The overall message is that testing saves significant time versus debugging, helps write better code, and is an essential part of the development process. Tests should cover all requirements and edge cases to
Testing in go
Tests are extremely importante in software development. This talk bring a quick introduction to the art of testing in Go, given a special focus on the standard lib, but also giving a quick glance at other alternatives.
Unit testing
Unit testing involves testing individual units or components of code to ensure they work as intended. It focuses on testing functional correctness, error handling, and input/output values. The main benefits are faster debugging, easier integration testing, and living documentation. Guidelines for effective unit testing include writing automated, independent, focused tests that cover boundaries and are easy to run and maintain.
Best Practices for Applications Performance Testing
The document outlines best practices and tips for application performance testing. It discusses defining test plans that include load testing, stress testing, and other types of performance testing. Key best practices include testing early and often using an iterative approach, taking a DevOps approach where development and operations work as a team, considering the user experience, understanding different types of performance tests, building a complete performance model, and including performance testing in unit tests. The document also provides tips to avoid such as not allowing enough time and using a QA system that differs from production.
Hang fire
Hangfire is a library for .NET and .NET Core applications that allows easy enqueuing and processing of background jobs such as fire-and-forget, delayed, and recurring jobs without the need for a Windows service or separate process. It provides a unified programming model for handling background tasks in a reliable way and supports short, long, CPU-intensive, and I/O-intensive jobs. Hangfire is available as a NuGet package and supports scenarios such as fire-and-forget jobs, delayed jobs, recurring jobs, continuations, batches, and background processes.
Google test training
The document discusses Google Test, an open source unit testing framework for C++ that can also be used for testing C code, providing an overview of its features and how to implement unit tests using common patterns like test fixtures, assertions, and death tests to validate expected failures. It also covers best practices for writing effective unit tests, including keeping tests independent, focused, and fast-running.
seven-ways-to-run-flink-on-aws.pdf
This document provides an overview of Apache Flink and different ways to deploy Flink applications on cloud platforms. It discusses deploying Flink on EMR, EC2, ECS, EKS, Kinesis Data Analytics for Java, and Lambda. It recommends EMR, discusses advantages like managed Hadoop clusters, and disadvantages like needing to manage the cluster. It also provides an overview of Flink architecture, components like the JobManager and TaskManager, and the data flow API.
In the DOM, no one will hear you scream
The document discusses the history and development of the Document Object Model (DOM) from its early implementations in 1995 to modern standards. It outlines key milestones like DOM Level 1 in 1998, the rise of JavaScript frameworks like Prototype, jQuery and MooTools in 2005-2006, and ongoing work by the W3C and WHATWG. The talk will explore security issues that can arise from the DOM's ability to convert strings to executable code and demonstrate an attack technique called DOM clobbering.
ZIO Queue
At the heart of data processing, event-sourcing, actors, and much more is the queue—a data structure that allows producers to pass work to consumers in a flexible way. On the JVM, most libraries, including Akka, are powered by Java concurrent queues, which are reliable but were designed in a different era, for synchronous (blocking) procedural code. In this presentation, John A. De Goes—architect of the Scalaz 8 effect system—introduces IOQueue, a new type of queue powered by the Scalaz 8 IO monad. IOQueue never blocks and provides seamless, composable back-pressure across an entire application, without users having to think about the problem or write any special code. John will discuss how IOQueue achieves these remarkable properties, and show how the structure can be used to solve hard problems with just a few lines of type-safe, leak-free, composable Scala code. Come learn about the power of Scalaz to solve the hard problems of software development, in a principled way, without compromises.
Inter Process Communication
This document discusses various inter-process communication (IPC) mechanisms in Linux, including pipes, FIFOs, and message queues. Pipes allow one-way communication between related processes, while FIFOs (named pipes) allow communication between unrelated processes through named pipes that persist unlike anonymous pipes. Message queues provide more robust messaging between unrelated processes by allowing messages to be queued until received and optionally retrieved out-of-order or by message type. The document covers the key functions and system calls for creating and using each IPC mechanism in both shell and C programming.
So you think you can write a test case
This document provides guidance on writing effective test cases. It discusses that test cases are documentation that guide testing and serve as a record. Key components of a test case are test steps that provide clear instructions to testers, and expected results that describe how to verify the outcome. The document also outlines best practices like starting test case design after exploring the application, using clear and specific language, and providing supplemental materials like test data sheets to support testing. Maintaining test cases is important as applications evolve, requiring test cases to be revised as needed to continue supporting products.
What's New in v2 - AnsibleFest London 2015
This document discusses version 2 (V2) of Ansible, which refactors portions of Ansible's core executor engine to address technical debt. Key changes in V2 include improved error messages, new block and strategy execution plugins, execution-time evaluation of included tasks, and better object-oriented design. The goal is to improve testability and make it easier to add new features without breaking existing functionality. V2 can be tested now and will become the default in March 2015, while Ansible 1.9 will be the last major release using the original code.
How fun of privilege escalation Red Pill2017
This document discusses various methods for escalating privileges on Windows and Linux systems. It begins by covering remote exploitation of vulnerable services running with high privileges. It then covers other methods such as exploiting weak passwords, insecure file/registry permissions, misconfigured services, and kernel exploits. Specific examples discussed include exploiting sudo permissions, cron jobs, service binary path manipulation, and the DirtyCOW Linux privilege escalation.
Python Deserialization Attacks
Learn how Deserialization tends to vulnerability and which python modules are vulnerable to deserialization attacks.
C++ Unit Test with Google Testing Framework
The slides describe basic features from google test framework and also describe some techniques to make C++ code more testable
Software Testing
This document presents an overview of software testing. It defines software testing as evaluating a program or application under various conditions to check that it meets specifications, functions as intended, and is of high quality. The document outlines objectives of testing like uncovering errors, validating requirements, and generating high-quality test cases. It also defines key terms, describes testing methodologies like black box and white box testing, different testing levels from unit to system, and various types of tests.
What's hot (20)
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
Level Up! - Practical Windows Privilege Escalation
Level Up! - Practical Windows Privilege Escalation
Best Practices for Applications Performance Testing
Best Practices for Applications Performance Testing
Viewers also liked
Fuzzing
The document discusses fuzz testing or fuzzing, which is a software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program to test for security vulnerabilities or crashes. It provides examples of fuzzing network protocols like HTTP and fuzzing file formats. It also discusses different types of fuzzers and provides an example of vulnerable source code and a simple fuzzing scheme to test it.
Distributed Fuzzing Framework Design
The document discusses distributed fuzzing, which involves spreading the workload of fuzz testing across multiple machines to dig deeper faster. It proposes a distributed fuzzing solution with the following key components: a database to store fuzzing data, a web interface for management, virtual machine nodes running fuzzers and monitoring targets, and an RPC interface to coordinate communication between components. The goal is to make deployment and management of distributed fuzzing easy while avoiding vendor lock-in.
Fuzzing sucks!
This document introduces the Sulley fuzzing framework. It begins with background information on past fuzzing tools and their limitations. It then discusses Sulley's architecture, including its component breakdown and advanced features. Next, it covers usage and demos of Sulley through audits of Hewlett-Packard and Trend Micro software. Finally, it briefly mentions future development plans for Sulley.
Browser Fuzzing with a Twist (and a Shake) -- ZeroNights 2015
The web client is critical software to secure from any perspective. No matter if you're an organization or a casual client, you're typically just as vulnerable as anyone else. OSes are often supplemented with hardening toolsets or built-in mitigations as an extra measure to avoid compromise, but as with all things, they aren't completely solid either. Thus the need for systems that break systems, some of which deploy fuzzing and almost all of them work to find implementation bugs. Browser fuzzing has been explored and improved in many different ways over the past several years. In this presentation, we'll be primarily talking about a mutation engine that provides a somewhat novel technique for finding bugs in a still-ripe attack surface: the browser's rendering engine. This technique has the flexibility to be applied even more broadly than browsers, for example, there's initial support for fuzzing PDF readers. We'll also be discussing the tooling and infrastructure areas of the process, detailing what's needed to build a system that will scale and enable your fuzzing strategies to be successful. Finally, we can conclude the talk with some incubation results and how you can start making use of these fuzzing techniques today to find the bugs you need to exploit browsers or identify and fix the code responsible for each vulnerability.
0-knowledge fuzzing
The document discusses various fuzzing techniques including dumb fuzzing, smart fuzzing, evolutionary fuzzing, using cyclomatic complexity as a filter, detecting implicit loops with dominator trees, performing in-memory fuzzing by mutating memory locations and restoring snapshots, and comparing code coverage of good and mutated samples to determine when halting criteria is met. The speaker hopes to convey an understanding of these ideas through pictures rather than traditional presentation elements. Questions from the audience are also discussed.
FUZZING & SOFTWARE SECURITY TESTING
This document provides an overview of fuzz testing and fuzzing tools. It discusses what fuzzing is, the history and evolution of fuzzing, popular fuzzing tools like Peach Fuzz and Sulley, and fuzzing methods like generation-based, mutation-based, and byte flipping fuzzing. The document also covers the phases of fuzzing like identifying targets and inputs, generating fuzzed data, executing it, and monitoring for exceptions. Key fuzzing frameworks and tools from organizations like CERT and their capabilities are described as well.
Introduction to Browser Fuzzing
This document discusses fuzzing browsers to uncover security vulnerabilities. It explains that fuzzing involves sending malformed or unexpected input to programs to find crashes or bugs. Specifically for browsers, fuzzing is useful because browsers are commonly targeted and easy to test. Successful fuzzing can find issues like buffer overflows, integer overflows, and out of bound reads. Finding bugs through fuzzing can help secure systems and earn significant rewards through browser bug bounty programs.
Viewers also liked (7)
Browser Fuzzing with a Twist (and a Shake) -- ZeroNights 2015
Browser Fuzzing with a Twist (and a Shake) -- ZeroNights 2015
Similar to Security Testing: Fuzzing
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy™ is the premier free and open source end-to-end digital forensics platform built by Basis Technology and the digital forensics open source community. The platform has been in development since OSDF Con 2010, based on intense interest and collaboration from the digital forensics community, which determined the need for an open source end-to-end forensics platform that runs on Windows systems.
Autopsy version 3 is a complete rewrite from version 2 and is built to enable the creation of fast, thorough, and efficient hard drive investigation tools that can evolve with digital investigators’ needs. The standard installation includes features that rival commercial closed source offerings, without the associated costs.
FEATURES
Triage capability and real-time alerting
Automated workflow based on The Sleuth Kit™
Windows installation
Case management and report generation
Recent user activity extraction including: web history, recent documents, bookmarks, downloads, and registry analysis
Keyword and pattern search including: phone numbers, email addresses, URLs, and IP addresses
Hash lookup
Interesting files detection and timeline viewing
...and much more
For digital forensics investigators and analysts, there are numerous advantages to using open source software and software built on open source platforms like Autopsy and The Sleuth Kit:
• Transparent evidence extraction: Open source platforms allow you to look at the source code and to verify that the software is performing its functions in a forensically sound way. This can prove to be critical when testifying or preparing for litigation.
• Easily extensible: Open source platforms grow organically and as the needs of their consituents and users change, so does their functionality.
• Active community of users and developers: In addition to commercial support offered by Basis Technology,
there is a wealth of information that is available in a community that has evolved over the last 11 years where both users and developers are actively working to improve the software platform. This free knowledge base is an extremely powerful value add to your purchased enterprise support.
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
This document provides an overview of Autopsy 3.0 digital forensics software from Basis Technology. It discusses Autopsy's extensible framework that allows new modules to be added, its easy-to-use graphical interface, and how it provides fast results through automated ingest modules. The document demonstrates Autopsy's main features including ingest modules for hashing, keyword search, and web browser analysis, as well as content viewer modules and an external timeline viewer. It promotes upcoming training and a module writing competition, and encourages users and developers to get involved with the open source project.
Meetup tdd
The document summarizes a meetup on implementing test-driven development (TDD) using Munit 2.0. The agenda includes introductions, an overview of why TDD is useful, how to implement TDD using Munit, and a question and answer session. It then discusses networking time and next steps after the meetup. The document provides background on software testing, the traditional development approach versus TDD, advantages of TDD, and the three laws of TDD. It encourages participants to nominate themselves as future speakers and provide feedback to organizers.
Cyber security - It starts with the embedded system
Some of the most famous information breaches over the past few years have been a result of entry through embedded and IoT system environments. Often these breaches are a result of unexpected system architecture and service connectivity on the network that allows the hacker to enter through an embedded device and make their way to the financial or corporate servers. Experts in embedded security discuss key security issues for embedded systems and how to address them.
The (Memory) Safety Dance - SAS 2017 keynote
This presentation discusses defensive mitigations that have been introduced over the last several years and their effectiveness, and what it means for offensive research.
Building world-class security response and secure development processes
The document discusses building world-class security response and secure development processes for OpenDaylight. It outlines the SDN attack surface, recent vulnerabilities in OpenDaylight, and defensive technologies. It discusses security response best practices for open source projects and secure engineering best practices. The current status of OpenDaylight security response and engineering is described, along with the vision to improve reactive security response capabilities and implement more proactive security measures like automated checks and security training.
September 13, 2016: Security in the Age of Open Source:
As presented by Mike Pittenger, VP of Security Strategy, at a lunch and learn on September 13, 2016.
Learn how your organization can:
* Know what's inside your code by identifying the open source you're using
* Map against known vulnerabilities and accelerate remediation efforts
* Take action to effectively secure and manage open source without impacting your agile SDLC
Mengenal ZEUS Botnet Lebih Dekat
This document summarizes a presentation about the Zeus botnet. It introduces the speaker and the Honeynet Project. It then discusses how Zeus works, including its communication methods and evasion techniques. Statistics on Zeus infections globally and in Indonesia are provided. Methods for tracking and dismantling Zeus are described, including takedowns in 2012. The presentation concludes by calling for more participation in a national cyber attack monitoring initiative.
Started In Security Now I'm Here
This presentation by Christopher Grayson covers some lessons learned as a security professional that has made his way into software engineering full time.
DT project.pdf
This presentation outlines the development of a personal voice assistant called Scars. It discusses:
1) Scars aims to provide a user-friendly interface for tasks using voice commands and can assist with daily activities like conversations, searches, music, alarms and more.
2) Current assistants have issues with voice recognition of certain accents and are better suited for mobile than desktop. Scars aims to address these issues.
3) Scars uses machine learning to analyze user statements and provide optimal solutions to requests. It requires training on large datasets to work efficiently.
A (not-so-quick) Primer on iOS Encryption David Schuetz - NCC Group
This document provides an overview of iOS encryption. It discusses how iOS implements full disk encryption using a randomly generated encryption key (EMF key) and file-level encryption using per-file encryption keys. It describes how encryption keys are wrapped using class keys stored in a keybag, and how the keybag and class keys are encrypted using keys derived from the user's passcode. It also discusses weaknesses like jailbreaking, bugs, forensic tools, and accessing cloud data. The document outlines how Apple has strengthened encryption defaults and the addition of the Secure Enclave hardware component.
DEF CON 24 - Dinesh and Shetty - practical android application exploitation
The document provides an overview of a workshop on practical Android application exploitation. The workshop aims to teach skills for performing reverse engineering, static and dynamic testing, and binary analysis of Android applications. It will use demonstrations and hands-on exercises with custom applications like InsecureBankv2. The workshop focuses on discovery and remediation, targeting intermediate to advanced skill levels. It will cover tools, techniques, and common vulnerabilities to exploit Android applications.
SplunkLive! Charlotte Bronto Software
The document discusses the challenges of dealing with a massive amount of log data from sending over 55 million emails per day. It considers whether to build or buy a solution to parse and correlate logs from their entire technology stack. Splunk is presented as a powerful and easy to use solution that could be deployed with little engineering resources and provide an immediate return on investment at a potentially lower cost than building their own solution. Various use cases are described such as tracking email metrics, monitoring system health, security auditing, and troubleshooting issues. The presentation concludes by discussing educating others on Splunk and expanding its use for application monitoring and security.
Beyond security testing
This document provides an overview of secure software engineering and the role of security testers. It discusses how security should be considered a core feature rather than an afterthought in the development process. The document outlines Microsoft's Security Development Lifecycle (SDL) as a comprehensive software process model that embeds security activities throughout requirements, design, implementation, verification and evolution. It describes how threat modeling can be used to identify potential threats and vulnerabilities. Finally, it discusses the security tester's role in building test plans from threat models, testing component interfaces using data mutation techniques, and adopting a "hacker's mindset" to find security issues.
Samsung & The Path to Open Source Leadership (OBC)
Dr. Ibrahim Haddad, Head of Open Source Group, Samsung Research America, talks about Samsung's focus on improving it's open source leadership through contribution to key projects used in it's products.
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
In this presentation Stephan will discuss some recent research that emerged he was asked to build malicious applications that bypassed custom security controls. He will walk through some of the basics of reversing malicious apps for android as well as common android malware techniques and methodologies. From the analysis of the wild android malware, he will discuss techniques and functionality to include when penetration testing against 3rd-party android security controls.
BIO
Stephan Chenette is the Director of Security Research and Development at IOActive where he conducts ongoing research to support internal and external security initiatives within the IOActive Labs. Stephan has been in involved in security research for the last 10 years and has presented at numerous conferences including: Blackhat, CanSecWest, RSA, EkoParty, RECon, AusCERT, ToorCon, SecTor, SOURCE, OWASP, B-Sides and PacSec. His specialty is in writing research tools for both the offensive and defensive front as well as investigating next generation emerging threats. He has released public analyses on various vulnerabilities and malware. Prior to joining IOActive, Stephan was the head security researcher at Websense for 6 years and a security software engineer for 4 years working in research and product development at eEye Digital Security.
Lesson 4
Technical hardware and software failures can compromise security if they are not addressed properly. Hardware failures may be due to known or unknown flaws and can cause unreliable service. Software bugs are also common given the large amount of code written. Common software failures include buffer overflows, SQL injection, and cross-site scripting. Secure software development processes like the Software Assurance Common Body of Knowledge can help address these issues and lead to more secure applications.
Information Assurance And Security - Chapter 2 - Lesson 4
Technical hardware and software failures can compromise security if they are not addressed properly. Hardware failures may be due to known or unknown flaws and can cause unreliable service. Software bugs are also common due to the complexity of code. Examples of dangerous software failures include buffer overflows, SQL injection, and cross-site scripting. Developers must follow secure practices like minimizing privileges and implementing access controls to develop more secure software and systems.
IoT is Something to Figure Out
Talk from IoT World in Santa Clara, May 12, 2016. How to make IoT objects interoperable and adapble by adding JavaScript. Introduces XS6 open source JavaScript engine optimized for embedded development. Hat tip to Hallelujah the Hills for the epigrams.
Enterprise PHP
A presentation on PHP's position in the enterprise, its past & present, how to get ready for developing for enterprise.
Inspired by Ivo Jansch's "PHP in the real wolrd" presentation.
Presented at SoftExpo 2010, Dhaka, Bangladesh.
Similar to Security Testing: Fuzzing (20)
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Autopsy 3: Free Open Source End-to-End Windows-based Digital Forensics Platform
Cyber security - It starts with the embedded system
Cyber security - It starts with the embedded system
Building world-class security response and secure development processes
Building world-class security response and secure development processes
September 13, 2016: Security in the Age of Open Source:
September 13, 2016: Security in the Age of Open Source:
A (not-so-quick) Primer on iOS Encryption David Schuetz - NCC Group
A (not-so-quick) Primer on iOS Encryption David Schuetz - NCC Group
DEF CON 24 - Dinesh and Shetty - practical android application exploitation
DEF CON 24 - Dinesh and Shetty - practical android application exploitation
Samsung & The Path to Open Source Leadership (OBC)
Samsung & The Path to Open Source Leadership (OBC)
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
2013 Toorcon San Diego Building Custom Android Malware for Penetration Testing
Information Assurance And Security - Chapter 2 - Lesson 4
Information Assurance And Security - Chapter 2 - Lesson 4
Recently uploaded
UiPath Test Automation using UiPath Test Suite series, part 6
Welcome to UiPath Test Automation using UiPath Test Suite series part 6. In this session, we will cover Test Automation with generative AI and Open AI.
UiPath Test Automation with generative AI and Open AI webinar offers an in-depth exploration of leveraging cutting-edge technologies for test automation within the UiPath platform. Attendees will delve into the integration of generative AI, a test automation solution, with Open AI advanced natural language processing capabilities.
Throughout the session, participants will discover how this synergy empowers testers to automate repetitive tasks, enhance testing accuracy, and expedite the software testing life cycle. Topics covered include the seamless integration process, practical use cases, and the benefits of harnessing AI-driven automation for UiPath testing initiatives. By attending this webinar, testers, and automation professionals can gain valuable insights into harnessing the power of AI to optimize their test automation workflows within the UiPath ecosystem, ultimately driving efficiency and quality in software development processes.
What will you get from this session?
1. Insights into integrating generative AI.
2. Understanding how this integration enhances test automation within the UiPath platform
3. Practical demonstrations
4. Exploration of real-world use cases illustrating the benefits of AI-driven test automation for UiPath
Topics covered:
What is generative AI
Test Automation with generative AI and Open AI.
UiPath integration with generative AI
Speaker:
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for life science domain, where you retriever information from biomedical knowledge graphs using LLMs to increase the accuracy and performance of generated answers
Microsoft - Power Platform_G.Aspiotis.pdf
Revolutionizing Application Development
with AI-powered low-code, presentation by George Aspiotis, Sr. Partner Development Manager, Microsoft
Building Production Ready Search Pipelines with Spark and Milvus
Spark is the widely used ETL tool for processing, indexing and ingesting data to serving stack for search. Milvus is the production-ready open-source vector database. In this talk we will show how to use Spark to process unstructured data to extract vector representations, and push the vectors to Milvus vector database for search serving.
UiPath Test Automation using UiPath Test Suite series, part 5
Welcome to UiPath Test Automation using UiPath Test Suite series part 5. In this session, we will cover CI/CD with devops.
Topics covered:
CI/CD with in UiPath
End-to-end overview of CI/CD pipeline with Azure devops
Speaker:
Lyndsey Byblow, Test Suite Sales Engineer @ UiPath, Inc.
How to Get CNIC Information System with Paksim Ga.pptx
Pakdata Cf is a groundbreaking system designed to streamline and facilitate access to CNIC information. This innovative platform leverages advanced technology to provide users with efficient and secure access to their CNIC details.
Programming Foundation Models with DSPy - Meetup Slides
Prompting language models is hard, while programming language models is easy. In this talk, I will discuss the state-of-the-art framework DSPy for programming foundation models with its powerful optimizers and runtime constraint system.
TrustArc Webinar - 2024 Global Privacy Survey
How does your privacy program stack up against your peers? What challenges are privacy teams tackling and prioritizing in 2024?
In the fifth annual Global Privacy Benchmarks Survey, we asked over 1,800 global privacy professionals and business executives to share their perspectives on the current state of privacy inside and outside of their organizations. This year’s report focused on emerging areas of importance for privacy and compliance professionals, including considerations and implications of Artificial Intelligence (AI) technologies, building brand trust, and different approaches for achieving higher privacy competence scores.
See how organizational priorities and strategic approaches to data security and privacy are evolving around the globe.
This webinar will review:
- The top 10 privacy insights from the fifth annual Global Privacy Benchmarks Survey
- The top challenges for privacy leaders, practitioners, and organizations in 2024
- Key themes to consider in developing and maintaining your privacy program
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Maruthi Prithivirajan, Head of ASEAN & IN Solution Architecture, Neo4j
Get an inside look at the latest Neo4j innovations that enable relationship-driven intelligence at scale. Learn more about the newest cloud integrations and product enhancements that make Neo4j an essential choice for developers building apps with interconnected data and generative AI.
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
The choice of an operating system plays a pivotal role in shaping our computing experience. For decades, Microsoft's Windows has dominated the market, offering a familiar and widely adopted platform for personal and professional use. However, as technological advancements continue to push the boundaries of innovation, alternative operating systems have emerged, challenging the status quo and offering users a fresh perspective on computing.
One such alternative that has garnered significant attention and acclaim is Nitrux Linux 3.5.0, a sleek, powerful, and user-friendly Linux distribution that promises to redefine the way we interact with our devices. With its focus on performance, security, and customization, Nitrux Linux presents a compelling case for those seeking to break free from the constraints of proprietary software and embrace the freedom and flexibility of open-source computing.
Best 20 SEO Techniques To Improve Website Visibility In SERP
Boost your website's visibility with proven SEO techniques! Our latest blog dives into essential strategies to enhance your online presence, increase traffic, and rank higher on search engines. From keyword optimization to quality content creation, learn how to make your site stand out in the crowded digital landscape. Discover actionable tips and expert insights to elevate your SEO game.
Communications Mining Series - Zero to Hero - Session 1
This session provides introduction to UiPath Communication Mining, importance and platform overview. You will acquire a good understand of the phases in Communication Mining as we go over the platform with you. Topics covered:
• Communication Mining Overview
• Why is it important?
• How can it help today’s business and the benefits
• Phases in Communication Mining
• Demo on Platform overview
• Q/A
Video Streaming: Then, Now, and in the Future
In his public lecture, Christian Timmerer provides insights into the fascinating history of video streaming, starting from its humble beginnings before YouTube to the groundbreaking technologies that now dominate platforms like Netflix and ORF ON. Timmerer also presents provocative contributions of his own that have significantly influenced the industry. He concludes by looking at future challenges and invites the audience to join in a discussion.
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
Webinar Recording: https://www.panagenda.com/webinars/hcl-notes-und-domino-lizenzkostenreduzierung-in-der-welt-von-dlau/
DLAU und die Lizenzen nach dem CCB- und CCX-Modell sind für viele in der HCL-Community seit letztem Jahr ein heißes Thema. Als Notes- oder Domino-Kunde haben Sie vielleicht mit unerwartet hohen Benutzerzahlen und Lizenzgebühren zu kämpfen. Sie fragen sich vielleicht, wie diese neue Art der Lizenzierung funktioniert und welchen Nutzen sie Ihnen bringt. Vor allem wollen Sie sicherlich Ihr Budget einhalten und Kosten sparen, wo immer möglich. Das verstehen wir und wir möchten Ihnen dabei helfen!
Wir erklären Ihnen, wie Sie häufige Konfigurationsprobleme lösen können, die dazu führen können, dass mehr Benutzer gezählt werden als nötig, und wie Sie überflüssige oder ungenutzte Konten identifizieren und entfernen können, um Geld zu sparen. Es gibt auch einige Ansätze, die zu unnötigen Ausgaben führen können, z. B. wenn ein Personendokument anstelle eines Mail-Ins für geteilte Mailboxen verwendet wird. Wir zeigen Ihnen solche Fälle und deren Lösungen. Und natürlich erklären wir Ihnen das neue Lizenzmodell.
Nehmen Sie an diesem Webinar teil, bei dem HCL-Ambassador Marc Thomas und Gastredner Franz Walder Ihnen diese neue Welt näherbringen. Es vermittelt Ihnen die Tools und das Know-how, um den Überblick zu bewahren. Sie werden in der Lage sein, Ihre Kosten durch eine optimierte Domino-Konfiguration zu reduzieren und auch in Zukunft gering zu halten.
Diese Themen werden behandelt
- Reduzierung der Lizenzkosten durch Auffinden und Beheben von Fehlkonfigurationen und überflüssigen Konten
- Wie funktionieren CCB- und CCX-Lizenzen wirklich?
- Verstehen des DLAU-Tools und wie man es am besten nutzt
- Tipps für häufige Problembereiche, wie z. B. Team-Postfächer, Funktions-/Testbenutzer usw.
- Praxisbeispiele und Best Practices zum sofortigen Umsetzen
Mind map of terminologies used in context of Generative AI
Mind map of common terms used in context of Generative AI.
“I’m still / I’m still / Chaining from the Block”
“An Outlook of the Ongoing and Future Relationship between Blockchain Technologies and Process-aware Information Systems.” Invited talk at the joint workshop on Blockchain for Information Systems (BC4IS) and Blockchain for Trusted Data Sharing (B4TDS), co-located with with the 36th International Conference on Advanced Information Systems Engineering (CAiSE), 3 June 2024, Limassol, Cyprus.
HCL Notes and Domino License Cost Reduction in the World of DLAU
Webinar Recording: https://www.panagenda.com/webinars/hcl-notes-and-domino-license-cost-reduction-in-the-world-of-dlau/
The introduction of DLAU and the CCB & CCX licensing model caused quite a stir in the HCL community. As a Notes and Domino customer, you may have faced challenges with unexpected user counts and license costs. You probably have questions on how this new licensing approach works and how to benefit from it. Most importantly, you likely have budget constraints and want to save money where possible. Don’t worry, we can help with all of this!
We’ll show you how to fix common misconfigurations that cause higher-than-expected user counts, and how to identify accounts which you can deactivate to save money. There are also frequent patterns that can cause unnecessary cost, like using a person document instead of a mail-in for shared mailboxes. We’ll provide examples and solutions for those as well. And naturally we’ll explain the new licensing model.
Join HCL Ambassador Marc Thomas in this webinar with a special guest appearance from Franz Walder. It will give you the tools and know-how to stay on top of what is going on with Domino licensing. You will be able lower your cost through an optimized configuration and keep it low going forward.
These topics will be covered
- Reducing license cost by finding and fixing misconfigurations and superfluous accounts
- How do CCB and CCX licenses really work?
- Understanding the DLAU tool and how to best utilize it
- Tips for common problem areas, like team mailboxes, functional/test users, etc
- Practical examples and best practices to implement right away
20240609 QFM020 Irresponsible AI Reading List May 2024
Everything I found interesting about the irresponsible use of machine intelligence in May 2024
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Are you ready to revolutionize how you handle data? Join us for a webinar where we’ll bring you up to speed with the latest advancements in Generative AI technology and discover how leveraging FME with tools from giants like Google Gemini, Amazon, and Microsoft OpenAI can supercharge your workflow efficiency.
During the hour, we’ll take you through:
Guest Speaker Segment with Hannah Barrington: Dive into the world of dynamic real estate marketing with Hannah, the Marketing Manager at Workspace Group. Hear firsthand how their team generates engaging descriptions for thousands of office units by integrating diverse data sources—from PDF floorplans to web pages—using FME transformers, like OpenAIVisionConnector and AnthropicVisionConnector. This use case will show you how GenAI can streamline content creation for marketing across the board.
Ollama Use Case: Learn how Scenario Specialist Dmitri Bagh has utilized Ollama within FME to input data, create custom models, and enhance security protocols. This segment will include demos to illustrate the full capabilities of FME in AI-driven processes.
Custom AI Models: Discover how to leverage FME to build personalized AI models using your data. Whether it’s populating a model with local data for added security or integrating public AI tools, find out how FME facilitates a versatile and secure approach to AI.
We’ll wrap up with a live Q&A session where you can engage with our experts on your specific use cases, and learn more about optimizing your data workflows with AI.
This webinar is ideal for professionals seeking to harness the power of AI within their data management systems while ensuring high levels of customization and security. Whether you're a novice or an expert, gain actionable insights and strategies to elevate your data processes. Join us to see how FME and AI can revolutionize how you work with data!
Recently uploaded (20)
UiPath Test Automation using UiPath Test Suite series, part 6
UiPath Test Automation using UiPath Test Suite series, part 6
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
UiPath Test Automation using UiPath Test Suite series, part 5
UiPath Test Automation using UiPath Test Suite series, part 5
How to Get CNIC Information System with Paksim Ga.pptx
How to Get CNIC Information System with Paksim Ga.pptx
Programming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup Slides
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
Mind map of terminologies used in context of Generative AI
Mind map of terminologies used in context of Generative AI
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Security Testing: Fuzzing
- 1. Security Testing: Fuzzing Andrei Rubaniuk for Seattle Code Camp 2012
- 2. Agenda • Introduction • What is Fuzzing? • Why Fuzz? • How to Fuzz? • Fuzzing Demo • Q&A © 2012 Andrei Rubaniuk 2
- 3. Introduction Who am I? – Software Engineer in Mobile space since 2005 – Past Projects: SlovoEd (PalmOS), Symbian OS/UIQ, SCMDM, Zune, Windows Phone 7 and 7.5 © 2012 Andrei Rubaniuk 3
- 4. Introduction (continued) What am doing now? – At Microsoft since October 2008 – Current organization – Windows Phone • SDL Tools Team • Helping Windows Phone org to Fuzz their code © 2012 Andrei Rubaniuk 4
- 5. What is Fuzzing? • Testing technique that involves providing malformed inputs to software • Fuzzed (attacked) process is monitored for exceptions, crashes, memory leaks • Is commonly used to test programs that receive data from unsafe sources (i.e. e-mail client, browser, media player) © 2012 Andrei Rubaniuk 5
- 6. What is Fuzzing? (continued) • Attacked process usually has parser (network protocols, document viewers) • Especially useful against proprietary software as it does not require access to source code • Became widely used in the past 10-15 years © 2012 Andrei Rubaniuk 6
- 7. What is Fuzzing? (continued) • Is not a substitute for other types of testing (unit tests, BVTs/FVTs, stress, etc.) • Cannot prove that your code is bug free • But will increase confidence in the correctness of your code! © 2012 Andrei Rubaniuk 7
- 8. What is Fuzzing? (continued) • Types of Fuzzing – Mutational • Smart – knows/learns about the data it mutates • Dumb – mutates data with no regard to its format – Generational • Allows to define specific data format (i.e. file structure) © 2012 Andrei Rubaniuk 8
- 9. Why Fuzz? • Relatively simple testing technique • Very effective at finding security bugs (DoS, Buffer Overflow, etc.) – Widely used by pentesters and hackers – Required by Microsoft Secure Development Lifecycle (SDL) • Inexpensive to implement – There are many free and commercial products (from iDefense, Codenomicon, etc.) – You can quickly implement your own fuzzer! • It’s Fun! © 2012 Andrei Rubaniuk 9
- 10. How to Fuzz? • Choose attacked program • Make sure generated input thoroughly covers possible input space of attacked program – To be efficient it should have good code coverage • Start Fuzzing and be Patient – Lots of bugs are found only after 100K or even millions of iterations – For example, for File Fuzzing Microsoft SDL requires min 100K iterations © 2012 Andrei Rubaniuk 10
- 11. How to Fuzz? (continued) • Analyze found issues • Fuzzed data is your repro – open a bug! • Iterate and be Patient! © 2012 Andrei Rubaniuk 11
- 12. Fuzzing Demo: MiniFuzz • Free basic file fuzzing tool written by Microsoft SDL Team • Web: http://www.microsoft.com/security/sdl/adopt /tools.aspx © 2012 Andrei Rubaniuk 12
- 13. Fuzzing Demo: MiniFuzz (continued) © 2012 Andrei Rubaniuk 13
- 14. Fuzzing Demo: fuzzed code © 2012 Andrei Rubaniuk 14
- 15. Fuzzing Demo: Actual Demo © 2012 Andrei Rubaniuk 15
- 16. Q&A © 2012 Andrei Rubaniuk 16
- 17. Follow-up • Questions? Suggestions? Feedback? © 2012 Andrei Rubaniuk 17