HackerTrans
TopNewTrendsCommentsPastAskShowJobs

bynxbynx

no profile record

comments

bynxbynx
·anno scorso·discuss
While I find this mildly annoying at times, it's a good reminder that I can just hardcode the port if I want HTTP
bynxbynx
·4 anni fa·discuss
Learning how to is half the fun!

There's a bunch of good tutorials out there on [dumb] fuzzing (presumably where you'll start). One starting point I'd recommend is taking a binary that accepts input from stdin and making some proof-of-concepts with AFL (https://lcamtuf.coredump.cx/afl/).

If you'd rather start from a code/library perspective (and not CLI), I'd recommend libfuzzer (https://github.com/Dor1s/libfuzzer-workshop/).

There's a lot of other fuzzers, techniques, and depth to the field, but I'd recommend inch worming through (speed up as you gain more comfort). The Fuzzing Book is good to help you understand the logic behind techniques and strategies (https://www.fuzzingbook.org/)

As for some management, there's a few decent "monitoring" systems out there; personally I just SSH in and check the fuzzer manually (I leave it running in a tmux pane), but if that's not your cup of tea I've heard good things about OneFuzz (https://github.com/microsoft/onefuzz) and LuckyCat (https://github.com/fkie-cad/LuckyCAT).

Happy to answer any specifics of the sort :)
bynxbynx
·4 anni fa·discuss
Anecdotal: I've seen a lot of people migrate to substack (not how much better it is, but I dont dislike visiting it like I dislike visiting a medium blog)
bynxbynx
·4 anni fa·discuss
I originally built my home server for academic use (computational physics), but after changing in security I've come to use it as a fuzzing playground.

Oftentimes I kick off a fuzzer on some OSS, e.g., GCC, v8, standard *nix binaries, and let it run for days/weeks/months. If I find anything I submit it to the appropriate people or make a PR, if Im motivated enough that week
bynxbynx
·5 anni fa·discuss
I've enjoyed dropshot (https://github.com/oxidecomputer/dropshot/) but recognize it's not for everyone :)