antonio-morales/Fuzzing101 — An step by step fuzzing tutorial. A GitHub Security Lab | Sourcevana

Fuzzing101

by antonio-morales

An step by step fuzzing tutorial. A GitHub Security Lab initiative

Verified Snapshot (7.8 MB)

3.8K421Updated 1y agoAbandoned

Quick Overview

AI summary will be generated soon. Check back later for an in-depth analysis of this project.

Scores

Trust Score

56

Star reputation (15%)72

Star velocity 7d (15%)0

Commit recency (15%)5

Fork ratio (10%)37

Issue ratio (10%)93

Contributor signal (10%)84

README quality (5%)100

License (5%)100

Homepage/demo (5%)100

Docs URL (5%)0

Topic count (5%)100

Maintenance

47

Commit frequency20

Issue management80

Documentation85

Popularity

54

Stars80

Forks40

Growth trend10

Star History

Snapshot Versions

README

Fuzzing-101

Do you want to learn how to fuzz like a real expert, but don't know how to start?

If so, this is the course for you!

10 real targets, 10 exercises. Are you able to solve all 10?

Structure

Exercise No.	Target	CVEs to find	Time estimated	Main topics
Exercise 1	Xpdf	CVE-2019-13288	120 mins	Afl-clang-fast, Afl-fuzz, GDB
Exercise 2	libexif	CVE-2009-3895, CVE-2012-2836	6 hours	Afl-clang-lto, Fuzz libraries, Eclipse IDE
Exercise 3	TCPdump	CVE-2017-13028	4 hours	ASan, Sanitizers
Exercise 4	LibTIFF	CVE-2016-9297	3 hours	Code coverage, LCOV
Exercise 5	Libxml2	CVE-2017-9048	3 hours	Dictionaries, Basic parallelization, Fuzzing command-line arguments
Exercise 6	GIMP	CVE-2016-4994, Bonus bugs	7 hours	Persistent fuzzing, Fuzzing interactive applications
Exercise 7	VLC media player	CVE-2019-14776	6 hours	Partial instrumentation, Fuzzing harness
Exercise 8	Adobe Reader		8 hours	Fuzzing closed-source applications, QEMU instrumentation
Exercise 9	7-Zip	CVE-2016-2334	8 hours	WinAFL, Fuzzing Windows Applications
Exercise 10 (Final Challenge)	Google Chrome / V8	CVE-2019-5847	8 hours	Fuzzilli, Fuzzing Javascript engines

Changelog

02/14/2022: Fixed some 'wget' typos in Exercise 5
11/25/2021: Exercise 3 updated with some fixes.

Who is the course intended for?