Fuzzing is a powerful technique for identifying vulnerabilities in software. This hands-on training will cover both the theory and practical aspects of fuzzing, including:

• Coverage-guided fuzzing
• Basic blocks and binary instrumentation
• Corpus collection and minimization
• Target selection
• Crash triage and root cause analysis
• Real-life CVE analysis

Attendees will have the opportunity to practice fuzzing on both Linux and Windows platforms. They will apply the concepts and techniques learned in the training to fuzz real-world software.

We will also explore how to customize WinAFL to add new features and tailor it to specific needs. This training is designed to be beginner-friendly and suitable for individuals with a basic understanding of software development and testing.

Topics Covered:

1. User Mode Fuzzing: Starting with fuzzing in user mode, we will gradually progress to more advanced topics.
2. Linux Kernel Fuzzing & Firmware Fuzzing: Learn how to fuzz the Linux kernel and embedded firmware.
3. Fuzzing Vulnerabilities: Understand the different types of vulnerabilities that fuzzing can uncover, including:
   • Buffer overflows
   • Heap overflows
   • Integer overflows
   • Use-after-free errors
   • Out-of-bounds read/write errors
   We will discuss the underlying causes and potential impacts of these vulnerabilities, as well as how to identify and address them through fuzzing.
4. Fuzzer Types: In addition to coverage-guided fuzzing, we will introduce other types of fuzzers such as:
   • Dumb fuzzers
   • Mutation fuzzers
   We will also discuss their benefits and limitations.
5. Debugging & Crash Analysis: Attendees will learn how to use powerful tools like:
   • GDB
   • WinDBG
   • Crashwalk
   These tools will help debug and analyze crashes, and perform root cause analysis to identify the underlying cause of vulnerabilities.
6. Advanced Debugging Techniques: Explore advanced debugging methods, including:
   • Time travel debugging on Windows
   • Measuring code coverage
   • Collecting and minimizing corpus

By the end of the training, attendees will be equipped with the skills and knowledge to conduct effective fuzzing on real-world software and identify critical vulnerabilities.

A three-day training on fuzzing, a powerful technique for identifying vulnerabilities in software. This hands-on training will cover the theory and practical aspects of fuzzing, including coverage-guided fuzzing, basic blocks and binary instrumentation, corpus collection and minimization, target selection, crash triage and root cause analysis, and real-life CVE analysis. Attendees will have the opportunity to practice fuzzing on open source software and apply the concepts and techniques learned in the training. This training is suitable for attendees with a basic understanding of software development and testing. In this training, attendees will learn about the different types of vulnerabilities that can be found through fuzzing, including buffer overflows, heap overflows, integer overflows, use-after-free errors, and out-of-bounds read/write errors. We will discuss the underlying causes and potential impacts of these vulnerabilities, as well as how to identify and address them through fuzzing.In addition to coverage-guided fuzzing, we will also introduce other types of fuzzer, such as dumb fuzzers and mutation fuzzers, and discuss their benefits and limitations. Attendees will also learn how to use tools such as GDB and Crashwalk to debug and analyze crashes, and to perform root cause analysis to identify the underlying cause of vulnerabilities.