Exposing Hidden Exploitable Behaviors In Programming Languages Using Differential Fuzzing
summary
A Python project performs differential fuzzing across JavaScript Perl PHP Python and Ruby implementations and reports concrete, reproducible surprises: undocumented functions that execute OS commands, error messages leaking sensitive files, native code interpreted unexpectedly, and constants treated as strings and run as shell commands. Examples include PHP treating missing constants as strings leading to system() execution, Perl executing code inside a stack trace, JRuby loading remote Ruby files, and a Python PAGER env var invoking arbitrary programs. Tool and full snippets are on the Black Hat paper.
AI-written summary · about
chapters (15)
- 0:00Intro
- 4:01Traditional Fuzzing
- 5:19Types of Bugs: Crashes (cont).
- 9:26Different Implementations
- 10:34Different Inputs
- 11:13Different Versions
- 12:47Different OS (cont).
- 14:55Extended Differential Fuzzing Framework
- 15:35Extended Differential Fuzzing: Python 1/3
- 17:03Extended Differential Fuzzing: Perl
- 17:37Extended Differential Fuzzing: JavaScript
- 18:08Extended Differential Fuzzing: JRuby
- 19:10Extended Differential Fuzzing: PHP 1/4
- 23:49Extended Differential Fuzzing: PHP 4/4
- 24:19Black Hat Sound Bytes
related talks
50mD2T2 - Exposing Hidden Exploitable Behaviors Using EDF
18mPreview: Verification (Correctness & Debugging)
53mThree Colours of Fuzzing: Reflections and Open Challenges
39mFuzzing: Finding Your Own Bugs and 0days!
01h 15mMake your programs more reliable with Fuzzing
50mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!
47mA New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!
52mStructure aware fuzzing