Fuzzing [OpenSecurityTraining2] Fuzzing 1001: Introductory white-box fuzzing with AFL++

[varwar]

About This Course​

This course provides an introduction to fuzzing, a software testing technique used to identify security vulnerabilities, bugs, and unexpected behavior in programs. Participants will gain a thorough understanding of fuzzing, including its goals, techniques, and practical applications in software security testing. The course covers a wide range of topics, such as the fundamentals of fuzzing, its working process, and various categories like mutation-based, generation-based, and coverage-guided fuzzing.

Advanced topics include using Address Sanitizer (ASAN) for memory error detection and specialized instrumentation like PCGUARD and LTO mode. Real-world exercises feature CVE analysis in software like Xpdf, libexif, and tcpdump, providing hands-on experience in applying fuzzing techniques to uncover vulnerabilities.

By the end of the course, participants will be equipped with the knowledge and skills to effectively use fuzzing to improve software security.

Syllabus​

1. Introduction
   • Fuzzing Introduction
   • AFL Introduction
2. Hands On
   • Lab Setup
   • The First Fuzzing
   • Slicing
   • Fuzzing Xpdf
3. Advanced Instrumentation pt.1
   • PCGUARD vs LTO
   • Fuzzing libexif
4. Advanced Instrumentation pt.2
   • ASAN
   • Fuzzing TCPdump

Requirements​

• Basic knowledge of software development and programming (preferably in C/C++ or similar languages)
• Basic understanding of the C/C++ compilation process, as well as familiarity with tools like CMake, Make, and related build system
• Familiarity with software security concepts
• Access to a computer with Linux (or a Linux VM) for hands-on exercises

Ссылка: https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Fuzz1001_Intro_AFL+2025_v1/about

 

[weaver]

30 июня должен появиться

Посмотрим что там будет.... По крайне мере лучший курс по фаззингу это пока что этот /threads/61626/ , а еще самое забавное, что используя exercise из курса люди даже свои статейки пишут.... (правда выглядит это не круто)

 

[shrekushka]

Fuzzing file parsers, codecs is noob friendly until you aim at something like a network daemon, browser.

а еще самое забавное, что используя exercise из курса люди даже свои статейки пишут.... (правда выглядит это не круто)

Here on our forum? or blogs in general?

PS. Tell me. I need more meme material.

 

[weaver]

Here on our forum? or blogs in general?

PS. Tell me. I need more meme material.

In blogs.... You can start making a meme

p.s. я думал там будет что-то интересное, а в итоге получили копию другого курса, при чем маленький его кусочек.

 

[varwar]

In blogs.... You can start making a meme


Посмотреть вложение 108834


p.s. я думал там будет что-то интересное, а в итоге получили копию другого курса, при чем маленький его кусочек.

Я не смотрел пока, поэтому ничего сказать не могу. Самому хотелось бы фаззинг другого софта посмотреть - ОС, браузеры. Но тогда курс уже был бы не вводным. В общем ожидания тоже были другими, но все равно посмотрю для общего развития.

 

[shrekushka]

In blogs.... You can start making a meme

(
trol101 : the dopamine hits harder when the victim backpedals and peaks when they switch to insults.

p.s. я думал там будет что-то интересное, а в итоге получили копию другого курса, при чем маленький его кусочек.

The Fuzzing Book

Welcome to "The Fuzzing Book"! Software has bugs, and catching bugs can involve lots of effort. This book addresses this problem by automating software testing, specifically by generating tests automatically. Recent years have seen the development of novel techniques that lead to dramatic...

www.fuzzingbook.org

Did you check this out? I haven’t, what’d you think?

 

[weaver]

(
trol101 : the dopamine hits harder when the victim backpedals and peaks when they switch to insults.

The Fuzzing Book

Welcome to "The Fuzzing Book"! Software has bugs, and catching bugs can involve lots of effort. This book addresses this problem by automating software testing, specifically by generating tests automatically. Recent years have seen the development of novel techniques that lead to dramatic...

www.fuzzingbook.org

Did you check this out? I haven’t, what’d you think?

I meant that it would have been possible to at least take another software and fuzz it, rather than make a copy from another course.
https://github.com/antonio-morales/fuzzing101 And this resource that you sent, I don't know about it either. I read the book, and reread it several times, I have a paper copy of it.