Since he was a student of the Faculty of Automatic Control and Computer Science at the Politehnica University of Bucharest, Alex started his career with an internship program at Google Summer of Code (GSoC) in 2014 and 2015 as Software Engineer. In 2016 he took an internship program at Radare Summer of Code and here he contributed to the open source reverse engineering framework. Since 2015 he is Teaching Assistant at the Politehnica University and also, he was part of the DLan Foundation team as Research & Development Engineer. Alex joined the the Security team at UiPath in March 2019.

Fuzzing the Stack for Fun and Profit

Fuzzing is a technique used in the security world to find software vulnerabilities by sending random or malformed inputs to a target application with the intent of discovering unexpected behavior, memory leaks or crashes which may indicate the presence of a security flaw.

A fuzzer ca be categorized based on the prior knowledge it has of the program structure, input structure of the input or the method it uses to generate the inputs.

This talk will present each of these methods and their limitations as well as introduce Smart Greybox Fuzzing, a new approach which leverages a high-level structural representation of the seed file to generate new files.

Key Takeaways:

· Generation-based vs mutation-based fuzzing

· Whitebox vs Greybox vs Blackbox fuzzing

· Dumb vs Smart Fuzzing

· Smart Greybox Fuzzing