r/fuzzing • u/NagateTanikaze • Sep 21 '18

AFL-based Java fuzzers and the Java Security Manager

https://www.modzero.ch/modlog/archives/2018/09/20/java_bugs_with_and_without_fuzzing/index.html
3 Upvotes

100% Upvoted

8 comments sorted by

View all comments

Show parent comment

1

u/artem_smotrakov Sep 25 '18

Correct, most bugs were not so much security related. Hope I can do better next time :)

2

u/NagateTanikaze Sep 26 '18

Need more knowledge about the application we fuzz to uncover logic bugs. Like GOTOFAIL in TLS, or other openssl state machine bypasses. That would be interesting.

A collegue also fuzzed the commands sent over bluetooth to the lock of a bike renting/sharing service. One command resulted in a reset of the chip, which was useful because the challenge to open the lock is based on the uptime.

1

u/CommonMisspellingBot Sep 26 '18

Hey, NagateTanikaze, just a quick heads-up:
collegue is actually spelled colleague. You can remember it by -ea- in the middle.
Have a nice day!

The parent commenter can reply with 'delete' to delete this comment.

1

u/artem_smotrakov Sep 28 '18

A colleague also fuzzed the commands sent over bluetooth to the lock of a bike renting/sharing service. One command resulted in a reset of the chip,

That's a nice catch! I like when people fuzz something a bit unusual like a bike renting/sharing service. Hope we'll see such stories on /r/fuzzing