(untitled)

Let's make a thread about fuzzing. One of my biggest dreams is to find a 0day all by my own. I have some CTF background, but finding vulns in the wild seems much harder to me. I've tried running afl and honggfuzz on several libs I have found in this repo: https://github.com/kozross/awesome-c and I also have done similar thing for awesome-cpp repo. Not a single crash have been found. I've seen that most of this libs have been already fuzzed lots of time by people more experienced than me. Where can I found some "not so often fuzzed" targets which are still "real world" (I don't want to attack ctf/hackme problems, I crave something real). I've been thinking about Android apps which use JNI, but I can't find any list of them (also, this would involve black-box fuzzing). Any tips? I know that it takes time, but I am young and horny and I want it all, I want it now xd.

look up vulnserver.exe is a project where exploit dev is really easy! play around with that then try some other software, I heard VLC has a lot of exploit potential.

>>7911 Isn't everyone trying to exploit VLC right now? Thanks for vulnserver, I will give it a try

>>7909 >Where can I found some "not so often fuzzed" targets which are still "real world" Anything that doesn't have a bug bounty program and doesn't have too many users. There are plenty of 0-star personal projects on github that are probably easy to attack. Or is that not what you want either. Also try thinking about non-obvious attack vectors. e.g. window decorators. I once found that Emerald crashed everytime I visited a certain website. Turns out whatever random soykaf you put into <title> tags leaves the browser and goes through a bunch of libraries and ends up at the top of your X window. That's an attack vector most people didn't think of.

>>7915 Yeah, 0-star projects seems good. What I want are vulns which aren't "meant to be" (in contrast to ctfs/hackmes)

Look into open source projects (even if they're old) and run vuln scanners on them. I found a couple of 0days that way.

>>7920 Could you provide which scanners are you using?

>CTF background You mean all this time I've been decompiling and debugging, I've been "capturing the flag" instead? I'm a edgy cool kid and didn't even know it. :P Maybe not, because I do it to fix problems, not cause them. Perhaps instead of trying to make other people look dumb by fuzzing their soykaf and then grandstanding about it, you should contribute fuzz testing to their development process and not be such a dick.

>>7909 nobody has yet suggested fuzzing the one thing everyone seems to always be freaking out about and making threads on constantly: ME/PSP, side-channel attacks, and the countless vulnerabilities and undocumented commands in the x86/amd64 instruction set. if it's so easy to make one simple javascript page that can take hypervisor control of every PC on the planet, why not actually do it?