Emilio Coppa from Sapienza University of Rome at the 3nd International KLEE Workshop on Symbolic Execution


KLEE Workshop 2022: https://srg.doc.ic.ac.uk/klee22/
Slides: https://srg.doc.ic.ac.uk/klee22/talks/Coppa-Fuzzing-Symbolic-Expressions.pdf

TTexplore is a library that performs path exploration on binary code using symbolic execution - JonathanSalwan/ttexplore

Solana is a blockchain with a $37 billion dollar market cap with the security of that chain relying on the security of the smart contracts on the chain - and we found very little research on the actual execution environment of those contracts. In contrast…

Contribute to googleprojectzero/SockFuzzer development by creating an account on GitHub.

ISLa is a grammar-aware string constraint solver with its own specification language.

In 1998 Tom was arrested for hacking, and was told he was looking at over 270 years in prison. Time for a career change! Tom went on to a life as an academic, earning a PhD in Artificial Intelligence, before starting a career as an SEO consultant (you think…

0:00 introduction
0:32 Looking at the fixed code
05:08 Cloning OpenSSL Repo and looking at the code
11:05 Compiling OpenSSL-3.0.7 version
13:21 Running test case binary
14:40 Getting vulnerable version of OpenSSL
16:32 Copying test cases for CVEs from openssl…

As long as a fuzzer is uncovering a steady stream of bugs, we can haveconfidence it’s serving its purpose. But a silent fuzzer is harder to interpret:is our ...

Go now supports fuzz testing natively as of Go 1.18, a tool that can be used to identify bugs and security vulnerabilities in your code. This talk will discuss how and why fuzzing can be used in Go, introduce differential fuzzing, and describe the mechanics…

Symbolic Execution can get a bad rap. Generic symbex tools have a hard time proving their worth when confronted with a sufficiently complex target. However, I have found symbolic execution can be very helpful in certain targeted situations. One of those situations…

Impalabs is releasing Hyperpom, a 64-bit ARM binary fuzzer written in Rust and based on the Apple Silicon's hypervisor. It is mutation-based and coverage-guided. This article gives an overview of its internals, presents the different components it consists…

A command-line fuzzer for the Apache JServ Protocol (ajp13) - doyensec/ajpfuzzer

Trail of Bits engineer Anish Naik guides you through Echidna, our Ethereum smart contract fuzzer. We will cover fuzzer setup, how to identify invariants—from simple to complex—and how to translate these invariants into code.

You can find more tutorials on…

Finding concurrency bugs has presented a challenge for security and development teams. Race condition-based vulnerabilities are a growing category of bugs reported to vendors and have been observed in in-the-wild exploits. Coverage-guided fuzzing has been…

00:00 Introduction
01:30 Cloning and compiling jackalope
04:45 Jackalope command line options
08:11 Damn Vulnerable C program compilation
11:05 Finding fuzzing function
12:43 Fuzzing with jackalope
17:30 Conclusion

In this video, we will show you how to…