Barbervisor: Journey developing a snapshot fuzzer with Intel VT-x

By Cory Duplantis. One of the ways vulnerability researchers find bugs is with fuzzing. At a high level, fuzzing is the process of generating and mutating random inputs for a given target to crash it. In 2017, I started developing a bare metal hypervisor for the purposes of snapshot fuzzing:...

cryptofuzz:cryptofuzz-boringssl-noasm: Use-of-uninitialized-value in fuzzing::memory::memory_test_msan

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5726830049624064 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-boringssl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type:...

aflnet

It is an offensive tool for Network protocols. The repository contains a greybox fuzzer for protocol implementations, named AFLNet. It takes a mutational approach and uses state-feedback, in addition to code-coverage feedback, to guide the fuzzing process. AFLNet is seeded with a corpus of record...

skia:sksl2spirv: Heap-use-after-free in SkSL::VariableReference::~VariableReference

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=4899879000997888 Project: skia Fuzzing Engine: afl Fuzz Target: sksl2spirv Job Type: aflasanskia Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60e00002c218 Crash State:...

skia:sksl2spirv: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5806581326020608 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: sksl2spirv Job Type: libfuzzerubsanskia Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: undefined UBSAN Crash...

libucl:ucl_add_string_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6498000277602304 Project: libucl Fuzzing Engine: libFuzzer Fuzz Target: ucladdstringfuzzer Job Type: libfuzzerubsanlibucl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000ec99ae8 Crash State: NULL Sanitizer: undefined UBSAN...

CWFF - Create Your Custom Wordlist For Fuzzing

CWFF is a tool that creates a special High quality fuzzing/content discovery wordlist for you at the highest speed possible using concurrency and it's heavily inspired by @tomnomnom's Who, What, Where, When, Wordlist NahamCon2020. Usage CWFF -h --threads --github --subdomains --recursive...

ndpi:fuzz_ndpi_reader: Heap-buffer-overflow in ndpi_workflow_process_packet

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=6256390180700160 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireader Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x604000000140...

rdkit:mol_data_stream_to_mol_fuzzer: Stack-buffer-overflow in RDKit::ParseMolBlockProperties

Detailed Report: https://oss-fuzz.com/testcase?key=5068710860292096 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldatastreamtomolfuzzer Job Type: libfuzzerasani386rdkit Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0xffca746f Crash State:...

suricata:fuzz_applayerparserparse: Heap-buffer-overflow in TLSDecodeHSHelloSessionID

Project: https://github.com/OISF/suricata.git Detailed Report: https://oss-fuzz.com/testcase?key=5733181224124416 Project: suricata Fuzzing Engine: libFuzzer Fuzz Target: fuzzapplayerparserparse Job Type: libfuzzerasansuricata Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address...

Oralyzer - Tool To Identify Open Redirection

Oralyzer, a simple python script, capable of identifying the open redirection vulnerability in a website. It does that by fuzzing the url i.e. provided as the input. Features Oralyzer can identify different types of Open Redirect Vulnerabilities : Header Based Javascript Based Meta Tag Based...

assimp:assimp_fuzzer: Heap-buffer-overflow in Assimp::IOStreamBuffer<char>::getNextDataLine

Detailed Report: https://oss-fuzz.com/testcase?key=5183227204206592 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerasanassimp Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x602000000200 Crash State:...

MMS Exploit Part 3: Constructing the Memory Corruption Primitives

Posted by Mateusz Jurczyk, Project Zero This post is the third of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published a...

onefuzz

:exclamation: IMPORTANT NOTICE :exclamation: August 31...

HawkScan - Security Tool For Reconnaissance And Information Gathering On A Website

Security Tool for Reconnaissance and Information Gathering on a website. python 2.x & 3.x This script use "WafW00f" to detect the WAF in the first step https://github.com/EnableSecurity/wafw00f This script use "Sublist3r" to scan subdomains https://github.com/aboul3la/Sublist3r This script use...

rdkit:smiles_string_to_mol_fuzzer: Stack-buffer-overflow in bool SmilesParseOps::parser::read_int<std::__1::__wrap_iter<char const*> >

Detailed Report: https://oss-fuzz.com/testcase?key=6210527601360896 Project: rdkit Fuzzing Engine: afl Fuzz Target: smilesstringtomolfuzzer Job Type: aflasanrdkit Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x7fff0e6f2108 Crash State: bool...

rdkit:mol_data_stream_to_mol_fuzzer: Bad-cast to RDKit::ATOM_EQUALS_QUERY' (aka 'EqualityQuery<int, const RDKit::Atom *, true>') from Queries::AndQuery<int, RDKit::Atom const*, true> in RDKit::completeMolQueries

Detailed Report: https://oss-fuzz.com/testcase?key=6283901044260864 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldatastreamtomolfuzzer Job Type: libfuzzerubsanrdkit Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000002a4a110 Crash State: Bad-cast to RDKit::ATOMEQUALSQUERY' a...

rdkit:smiles_string_to_mol_fuzzer: Heap-buffer-overflow in RDKit::Chirality::iterateCIPRanks

Detailed Report: https://oss-fuzz.com/testcase?key=5204811577556992 Project: rdkit Fuzzing Engine: afl Fuzz Target: smilesstringtomolfuzzer Job Type: aflasanrdkit Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x602000008274 Crash State: RDKit::Chirality::iterateCIPRan...

MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec

Posted by Mateusz Jurczyk, Project Zero This post is the second of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published ...

OSV-2020-1347 Negative-size-param in fuzz_tlv_to_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16703 Crash type: Negative-size-param Crash state: fuzztlvtostring fuzzparsemimetlv fuzzaddmimepart...