Fuzzing para-virtualized devices in Hyper-V

Introduction Introduction Hyper-V is the backbone of Azure, running on its Hosts to provide efficient and fair sharing of resources, but also isolation. That’s why we, in the vulnerability research team for Windows, have been working in the background for years now helping secure Hyper-V. And why...

Htcap - A Web Application Scanner Able To Crawl Single Page Application (SPA) In A Recursive Manner By Intercepting Ajax Calls And DOM Changes

Htcap is a web application scanner able to crawl single page application SPA in a recursive manner by intercepting ajax calls and DOM changes. Htcap is not just another vulnerability scanner since it's focused on the crawling process and it's aimed to detect and intercept ajax/fetch calls,...

readstat/fuzz_format_sas7bcat: Heap-buffer-overflow in readstat_convert

Project: https://github.com/WizardMac/ReadStat.git Detailed report: https://oss-fuzz.com/testcase?key=5673098437722112 Project: readstat Fuzzer: aflreadstatfuzzformatsas7bcat Fuzz target binary: fuzzformatsas7bcat Job Type: aflasanreadstat Platform Id: linux Crash Type: Heap-buffer-overflow READ ...

MemITM - Tool To Make In Memory Man In The Middle

The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to inspect them or alter them ...

FreeBSD : chromium -- multiple vulnerabilities (546d4dd4-10ea-11e9-b407-080027ef1a23)

Google Chrome Releases reports : 43 security fixes in this release, including : - High CVE-2018-17480: Out of bounds write in V8 - High CVE-2018-17481: Use after free in PDFium - High CVE-2018-18335: Heap buffer overflow in Skia - High CVE-2018-18336: Use after free in PDFium - High CVE-2018-1833...

clamav/clamav_scanmap_PDF_fuzzer: Heap-buffer-overflow in pdf_nextlinestart

Detailed report: https://oss-fuzz.com/testcase?key=5168958492114944 Project: clamav Fuzzer: aflclamavscanmapPDFfuzzer Fuzz target binary: clamavscanmapPDFfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x611000188a6a Crash State:...

Epic Holiday Cookie Baking

One aspect of being a penetration tester that is always rewarding is the process of rabbit-holing into an area of interest and letting the data guide me to my destination. Recently, while updating and testing new code on a custom cookie fuzzing tool Anomalous Cookie -...

Adventures in Video Conferencing Part 3: The Even Wilder World of WhatsApp

Posted by Natalie Silvanovich, Project Zero WhatsApp is another application that supports video conferencing that does not use WebRTC as its core implementation. Instead, it uses PJSIP, which contains some WebRTC code, but also contains a substantial amount of other code, and predates the WebRTC...

skia/api_mock_gpu_canvas: Heap-buffer-overflow in SkMatrix::setRSXform

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=6323754636935168 Project: skia Fuzzer: aflskiaapimockgpucanvas Fuzz target binary: apimockgpucanvas Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

Using Fuzzing to Mine for Zero-Days

Fuzzing is a term that sounds hard to take seriously. But it needs to be, in light of today’s attack landscape. Fuzzing has traditionally been a sophisticated technique used by professional threat researchers to discover vulnerabilities in hardware and software interfaces and applications. They d...

Adventures in Video Conferencing Part 2: Fun with FaceTime

Posted by Natalie Silvanovich, Project Zero FaceTime is Apple’s video conferencing application for iOS and Mac. It is closed source, and does not appear to use any third-party libraries for its core functionality. I wondered whether fuzzing the contents of FaceTime’s audio and video streams would...

wireshark/fuzzshark_ip_proto-udp: Stack-buffer-overflow in cdma2k_message_HANDOFF_DIR

Project: https://code.wireshark.org/review/wireshark Detailed report: https://oss-fuzz.com/testcase?key=5742878135943168 Project: wireshark Fuzzer: aflwiresharkfuzzsharkipproto-udp Fuzz target binary: fuzzsharkipproto-udp Job Type: aflasanwireshark Platform Id: linux Crash Type:...

XSSFuzzer - A Tool Which Generates XSS Payloads Based On User-Defined Vectors And Fuzzing Lists

XSS Fuzzer is a simple application written in plain HTML/JavaScript/CSS which generates XSS payloads based on user-defined vectors using multiple placeholders which are replaced with fuzzing lists. It offers the possibility to just generate the payloads as plain-text or to execute them inside an...

FAST or Burp or both?

By @aLLy , Wallarm Research Hello guys, time to talk details about Wallarm FAST Framework for Application Security Testing. It’s a new automatic web vulnerability scanning and fuzzing detection tool by Wallarm Inc. It is well suited for security researchers in enterprise Red Teams as well as for...

skia/api_image_filter: Use-of-uninitialized-value in SkTHashTable<SkGlyph, SkPackedGlyphID, SkGlyph::HashTraits>::find

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5766692521639936 Project: skia Fuzzer: libFuzzerskiaapiimagefilter Fuzz target binary: apiimagefilter Job Type: libfuzzermsanskia Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

Extending fuzzing with Burp by FAST

I love Burp Suite, like really. It’s the most convenient tool to visualize what’s happening with apps, what requests look like and to test simple things like XSS injection. At the same time, it’s really hard for me to do something more complicated, like implementing custom fuzzing with having to...

Stable Channel Update for Desktop

The stable channel has been updated to 70.0.3538.102 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. A list of all changes is available in the log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The...

Memory Man in the Middle: MemITM

The MemITM Mem In The Middle tool has been developed in order to easily intercept “messages” in Windows processes memory. We developed a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to inspect them or alter them to...

Isip - Interactive Sip Toolkit For Packet Manipulations, Sniffing, Man In The Middle Attacks, Fuzzing, Simulating Of Dos Attacks

Interactive sip toolkit for packet manipulations, sniffing, man in the middle attacks, fuzzing, simulating of dos attacks. Video Setup git clone https://github.com/halitalptekin/isip.git cd isip pip install -r requirements.txt Usage Packet manipulation tools are in packet cmd loop. First start, y...

XSStrike v3.0 - Most Advanced XSS Detection Suite

Why XSStrike? Every XSS scanner out there has a list of payloads, they inject the payloads and if the payload is reflected into the webpage, it is declared vulnerable but that's just stupid. XSStrike on the other hand analyses the response with multiple parsers and then crafts payloads that are...