Effectiveness and Scalability of Fuzzing Techniques in CI/CD Pipelines
https://arxiv.org/pdf/2205.14964.pdf
https://arxiv.org/pdf/2205.14964.pdf
Improving Security by Fuzzing the CNCF landscape - https://www.cncf.io/blog/2022/06/28/improving-security-by-fuzzing-the-cncf-landscape/
CNCF
Improving Security by Fuzzing the CNCF landscape
By Chris Aniszczyk (CNCF), Adam Korczynski (Ada Logics), David Korczynski (Ada Logics) In this blog post we present an overview of the state of fuzzing across CNCF projects. This is based on efforts…
👍2
Fuzzing Image Parsing in Windows, Part Four: More HEIF - https://www.mandiant.com/resources/fuzzing-image-parsing-windows-part-four
Google Cloud Blog
Fuzzing Image Parsing in Windows, Part Four: More HEIF | Google Cloud Blog
Another Way to Talk with Browser: Exploiting Chrome at Network Layer - https://i.blackhat.com/USA-22/Thursday/US-22-Rong-Another-Way-to-Talk-with-Browser-Exploiting-Chrome-at-Network-Layer.pdf
eBPF ELFs JMPing Through the Windows - https://i.blackhat.com/USA-22/Thursday/US-22-Johnson-eBPF-ELFs-JMPing-Through-the-Windows.pdf
👎1
Jazzer.Js Brings Fuzzing To JavaScript
https://www.code-intelligence.com/blog/jazzer.js
https://github.com/CodeIntelligenceTesting/jazzer.js
https://www.code-intelligence.com/blog/jazzer.js
https://github.com/CodeIntelligenceTesting/jazzer.js
Code-Intelligence
Jazzer.js Brings Effective Fuzzing to JavaScript (Open-Source)
Jazzer.js is an open-source fuzzer for the Node.js platform. It is based on libFuzzer and brings many of its features to the JavaScript ecosystem.
Attacking Firecracker: AWS' microVM Monitor Written in Rust - https://www.graplsecurity.com/post/attacking-firecracker
Jit-Picking: Differential Fuzzing of JavaScript Engines
https://publications.cispa.saarland/3773/1/2022-CCS-JIT-Fuzzing.pdf
https://publications.cispa.saarland/3773/1/2022-CCS-JIT-Fuzzing.pdf
Fuzzing Host-to Guest Attack Surface in Android Protected KVM
https://www.youtube.com/watch?v=cJjjlSG6JEA
https://www.youtube.com/watch?v=cJjjlSG6JEA
YouTube
Fuzzing Host-to Guest Attack Surface in Android Protected KVM- Eugene Rodionov & Will Deacon, Google
Fuzzing Host-to Guest Attack Surface in Android Protected KVM - Eugene Rodionov & Will Deacon, Google
Android 13 introduces native support of virtualization services built on top of Protected KVM (pKVM) for arm64 devices. Unlike in traditional KVM where…
Android 13 introduces native support of virtualization services built on top of Protected KVM (pKVM) for arm64 devices. Unlike in traditional KVM where…
Making Fuzzing Part of Your Software Development Lifecycle
https://www.youtube.com/watch?v=eg7SiXr31Qk
https://www.youtube.com/watch?v=eg7SiXr31Qk
YouTube
Making Fuzzing Part of Your Software Development Lifecycle - Jonathan Metzman, Google
Making Fuzzing Part of Your Software Development Lifecycle - Jonathan Metzman, Google
Fuzzing is a testing technique that uses randomized inputs to find bugs in software. Fuzzing is the most successful automated vulnetability/bug-finding technique and has…
Fuzzing is a testing technique that uses randomized inputs to find bugs in software. Fuzzing is the most successful automated vulnetability/bug-finding technique and has…
CONFETTI: Amplifying Concolic Guidance for Fuzzers
https://www.youtube.com/watch?v=4WOPUFNeZXg
https://srg.doc.ic.ac.uk/klee22/talks/Kukucka-Confetti.pdf
https://www.youtube.com/watch?v=4WOPUFNeZXg
https://srg.doc.ic.ac.uk/klee22/talks/Kukucka-Confetti.pdf
YouTube
CONFETTI: Amplifying Concolic Guidance for Fuzzers
James Kukucka from George Mason University at the 3nd International KLEE Workshop on Symbolic Execution
KLEE Workshop 2022: https://srg.doc.ic.ac.uk/klee22/
Slides: https://srg.doc.ic.ac.uk/klee22/talks/Kukucka-Confetti.pdf
KLEE Workshop 2022: https://srg.doc.ic.ac.uk/klee22/
Slides: https://srg.doc.ic.ac.uk/klee22/talks/Kukucka-Confetti.pdf
RedEye is a visual analytic tool supporting Red & Blue Team operations
https://github.com/cisagov/RedEye/
https://github.com/cisagov/RedEye/
GitHub
GitHub - cisagov/RedEye: RedEye is a visual analytic tool supporting Red & Blue Team operations
RedEye is a visual analytic tool supporting Red & Blue Team operations - cisagov/RedEye
A journey of fuzzing Nvidia graphic driver leading to LPE exploitation
https://drive.google.com/file/d/1HEaQ3o1kSnrzMCec1aiYMkWYQZg7Vjb3/view
https://drive.google.com/file/d/1HEaQ3o1kSnrzMCec1aiYMkWYQZg7Vjb3/view
Toss a Fault to Your Witcher: Applying Grey-box Coverage-Guided Mutational Fuzzing to Detect
SQL and Command Injection Vulnerabilities
https://pagabuc.me/docs/oakland23_witcher.pdf
SQL and Command Injection Vulnerabilities
https://pagabuc.me/docs/oakland23_witcher.pdf
👍1
Microsoft fixes driver blocklist placing users at risk from BYOVD attacks
https://www.malwarebytes.com/blog/news/2022/10/microsoft-fixes-driver-blocklist-placing-users-at-risk-from-byovd-attacks
https://www.malwarebytes.com/blog/news/2022/10/microsoft-fixes-driver-blocklist-placing-users-at-risk-from-byovd-attacks
Malwarebytes
Microsoft fixes driver blocklist placing users at risk from BYOVD attacks
There may be an all-new acronym for you to try and remember, as a result of Microsoft fixing a lingering issue. This...