Earn $200K by fuzzing for a weekend: Part 1 | secret club
By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing.
Earn $200K by fuzzing for a weekend: Part 1 addison May 11, 2022 By applying well-known fuzzing techniques to a popular target, I found several bugs that in total yielded over $200K in bounties. In this article I will demonstrate how powerful fuzzing can be when applied to software which has not yet faced sufficient testing. If you’re here just for the bug disclosures, see Part 2 , though I encourage you all, even those who have not yet tried their hand at fuzzing, to read through this. Exposition A few friends and I ran a little Discord server (now a Matrix space) which in which we discussed
Explore this link on the map →saved by
related reading
- Assessing Claude Mythos Preview’s cybersecurity capabilities \ Anthropicred.anthropic.com
- GitHub - antonio-morales/Fuzzing101: An step by step fuzzing tutorial. A GitHub Security Lab initiative · GitHubgithub.com
- Finding Miscompiles for Fun, Not Profit - by Justin Lebarnewsletter.semianalysis.com
- Rewriting Bun in Rust | Bun Blogbun.com
- Zenbleedlock.cmpxchg8b.com
- All my favorite tracing tools: eBPF, QEMU, Perfetto, new ones I built and more - Tristan Humethume.ca
- From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code - Project Zerogoogleprojectzero.blogspot.com
- Reading privileged memory with a side-channel - Project Zerogoogleprojectzero.blogspot.com
- Catching bugs with fractional proofs | Theoremtheorem.dev
- All learning materials - detailed | Web Security Academyportswigger.net
- There are Only Four Billion Floats-So Test Them All! | Random ASCII – tech blog of Bruce Dawsonrandomascii.wordpress.com
- From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code - Project Zerogoogleprojectzero.blogspot.com