RAVAGE - Runtime Analysis of Vulnerabilities and Generation of Exploits
summary
RAVAGE is a Java runtime analysis tool that tracks taint across wrapped objects to produce complete data flows and JSON-formatted issue reports, integrates with Burp and WebGoat, and pushes findings to Honeybadger or BeEF. The prototype is about 5,000 lines (C/C++/Java/assembly), detects XSS, SQLi and arbitrary redirect, and in experiments shows ~15% false positive and ~27% false negative rates; current implementation slows the JVM (20–50× without JIT changes) but successfully generates exploit URLs.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:54Agenda
- 1:53Static Analysis
- 3:28Blackbox Analysis
- 5:34Advantages
- 6:19Problems
- 8:16Graphs
- 9:36Statistics
- 12:33What is RAVAGE
- 13:02RAVAGE Design
- 15:06Data File
- 18:59Tracking Events
- 20:01Splitting Objects
- 21:37Recall Rapper
- 22:01Rapper
- 23:13Demo
- 23:25Web Goat Demo
- 29:50Implementation
- 36:20Mobility
- 44:43Summary
related talks
49mOpen-source vulnerability management? Use the source, Luke!
49mFixing the Unfixable: Solving Pervasive Vulnerabilities with RASP
56mThe Anatomy of Java Vulnerabilities
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
45mFinding Vulnerabilities through Static Analysis and Scripting
49mAn overview of available opensource tools to secure your Java code
50mStranger Danger: Your Java Attack Surface Just Got Bigger
46mLive hacking: Breaking into your Java web app