Fuzzing: The Age of Vulnerability Discovery

No ratings

Presented at No Hat 2023 by

In 2020, I discussed fuzzing in "Lightning in a Bottle" reviewing major milestones that led to the "fuzzing renaissance" that was kicked off by the creation of effective greybox mutational parser fuzzing with the release of American Fuzzy Lop. It is now 2023 and fuzzing continues to be one of the most effective approaches to vulnerability discovery, reaching an ever-wider range of attack surface in targets like browsers, kernels, trusted execution environments, smart contracts, mobile and embedded devices, managed languages and more. In this talk we will discover what the future trends and opportunities for fuzzing will look like. We will explore how the science of fuzzing has improved to augment early feedback methods, how the philosophy of fuzzing has evolved through benchmarking and empirical data, and how fuzzing tooling has become more flexible and adaptable to arbitrary targets. We will explore together what has happened since The Fuzzing Renaissance created a boom of research and began to mature as we shift into The Age of Vulnerability Discovery.