This course teaches you the foundations of fuzzing and how to apply it on real-world complex software. The course focuses on source-based fuzzing, which means that we will only fuzz software for which we have source code available (as opposed to fuzzing binary applications). Following this course you will be able to write fuzzers and find bugs in your favourite source code. The course is focused on delivering knowledge about the best tools and techniques in fuzzing, and doing so in a practical manner such that the knowledge can be applied on modern technology. The course is designed to have a big focus on hands-on tasks, so be ready to read the source of existing fuzzers and also to write actual fuzzers that find real bugs.
Why study fuzzing?Automating the process of uncovering programming errors in software is a well-known task. Fuzzing is one of the core techniques for doing this and the basic idea behind fuzzing is to send large amounts of pseudo-random inputs to a given target application and for each input observe whether the input triggers any faulty behaviour in the target. This technique has drastically increased in popularity in recent years. For example, the oss-fuzz project run by Google has found over 16,000 bugs in 250 open source projects since its inception in January 2017 to January 2020.
Many research efforts have been put into fuzzing, so whereas fuzzing was originally introduced as sending large amounts of random inputs, the concept has now evolved into sophisticated science that relies on rigorous program analysis techniques to optimally send “interesting’’ inputs in large amounts. Some fuzzers even adapt techniques from software verification to ensure a more calculated approach to crafting inputs. Fuzzing is particularly useful to finding memory corruption bugs that often trigger sophisticated exploits and can discover a variety of types like stack-based buffer overflows, heap-based buffer overflows, memory-out-of-bounds, null-pointer dereference and use-after-free.
Fuzzing is popular in the industry. The Behemoths of the software industry like Microsoft and Google have performed fuzzing for more than a decade now. DARPA invested more than 55 million in a project called Cyber Grand Challenge where more than 100 teams developed new techniques for automated vulnerability discovery and the vast majority of top-performing teams relied on Fuzzing as the main way of finding vulnerabilities. Fuzzing has empirically proven itself as a major way of automating the bug-finding process and the technique has placed itself as one of the de facto standards for ensuring secure software.
Learning objectives
- To gain a solid understanding of the foundations and background on fuzzing
- To get into details with modern fuzzers, focusing on the popular LibFuzzer
- To understand the concepts behind sanitizers and how to use them to find bugs
- To get hands-on experience with writing fuzzers for real-world applications
- To get hands-on experience with writing fuzzers for a range of diverse software applications, e.g. parsers, languages, browsers and databases
- To reinforce the above knowledge through exercises and hands-on experiences against realworld technologies
Who should attend?
- Software developers
- Security engineers
- Vulnerability researchers.
- Red team professionals
- Program analysis researchers
Prerequisites
In the course we will be reading a lot of C/C++ code, so it is expected that students are familiar with reading source code in these languages and also writing small applications.