Letting Your Fuzzer Knows About Target'S Internals

No ratings

Presented at TROOPERS 2010 by

If you just want to use fuzzers for QA purposes, this talk is not for you. If you want to really use fuzzers to find security vulnerabilities and write real exploit or at least to understand how people are actually doing that professionally, let's have fun together. This talk will cover the integration between fuzzers and debuggers, showing how important is to have target's internal information to discover complex vulnerabilities and to differentiate then from simple crashes. This problem is even increased when you have thousands crashes that needs to be analyzed and prioritized. Fuzzers became the most important technology in finding software vulnerabilities nowadays. The biggest problem in fuzzing is to determine the exploitability of the problems you will find. We are going to show the ideas behind the tools and the tools in action.