SANS GIAC Exploit Researcher and Advanced Penetration Tester (GXPN), Offensive Security Certified Professional (OSCP) and Offensive Security Certified Expert (OSCE) with 5 years of penetration testing experience and a comprehensive background in C/C++ programming, reverse engineering, and general network and infrastructure security. Currently developing security tools including Open Web Application Security Project (OWASP) and client-server infrastructure for a new approach to port knocking.

How to Fuzz like a Hacker

One of today’s security research pillar is fuzzing. For the last year a huge number of bug were found using this technique. However, the days where fuzzers were reporting hundreds of exploitable crashes are gone. To keep up with the changing landscape and ever-increasing complexity of applications, fuzzers must become more sophisticated and faster. They are evolving from “dumb”, random input generation techniques to intelligent tools using genetic algorithms and coverage-guided engines.

This presentation will focus on methods that can be applied to optimize the fuzzing process and makes it more efficient. It includes tools and strategies like: Address Sanitizer, different distribution strategies, instrumentation and hardware advantages (depends on architecture). All those examples will be presented based on the current open-source leader, AFL.