D1T1 - Fuzzing Javascript Engines for Fun and Pwnage

on YouTube ↗31m

" summary

Built a JavaScript fuzzing factory that runs in Docker with a Node.js web UI and EC2 nodes (4 vCPU, 8GB), uses in‑memory input by patching engines to cut disk IO, and runs two engines: Bella (mutation) that turns one‑day PoCs into L.E.G.O. templates and Benjamin (generation) that emits grammar/APIs. Crashes feed a regex-based collector with three-class classification; result: about ten reported bugs including a Safari JavaScriptCore heap buffer overflow in WASM parsing, and the framework is slated for GitHub release.

AI-written summary · about

" chapters (12)

1. 0:00Introduction
2. 0:40Speakers and Agenda
3. 2:06Goals and Motivation
4. 5:11Fuzzing Factory Overview
5. 8:04Factory Implementation
6. 10:39Mutation-Based Fuzzing
7. 12:39Generation-Based Fuzzing
8. 14:35Crash Collector
9. 16:23Crash Demonstration
10. 18:16Factory Demonstration
11. 23:19Limitations and Future
12. 25:07Q&A Session

" related talks

• 53mFuzz Testing for Fun and ProfitMELISSA BENUA · BSides Huntsville 2021
• 52mStructure aware fuzzingRéka Kovács · Meeting C++ 2018
• 28mFuzzing Malware for Fun & ProfitMaksim Shudrak · BSidesSF 2019
• 27mAttacking the WebAssembly Compiler of WebKitBohan Liu, Zong Cao (P1umer), Yeqi Fu (Q1IQ), Fangming Gu (afang5472), Zheng Wang (xmzyshypnc) · Black Hat Asia 2023
• 37mReviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome BrowserBohan Liu, Zheng Wang · Black Hat Europe 2023
• 53mThree Colours of Fuzzing: Reflections and Open ChallengesCristian Cadar · LCTES 2024
• 29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a BugQingyu Li, Huinian Yang · Black Hat Europe 2022
• 33mOffensive Javascript Techniques for Red TeamersDylan Ayrey, Christian Frichot · BSidesSF 2019