Find Bugs in js/npm/nodejs code using Fuzz Testing (jsfuzz) - JavaScript Security #1

preview_player
Показать описание

In this course, I will fuzz a JavaScript npm/nodejs library (omggif) in order to find uncaught JavaScript exceptions. I will explain how to create a fuzzing harness for this target, run the fuzzer (jsfuzz), handle expected exceptions, analyze a crash and create a minimal crash reproducer.

#Fuzzing #Javascript #npm

0:00 Introduction
1:34 Presentation of jsfuzz
3:13 Presentation of the target (omggif)
4:38 Creating the fuzzing target for jsfuzz
6:50 Launching the fuzzer
8:00 Improving the fuzzing harness (try...catch...)
12:34 Bug triggered: TypeError
14:09 Improving the corpora to get better coverage
15:44 Other options of jsfuzz
16:53 Bug analysis (crash reproducer and backtrace)

Further readings:

📡 Socials:

Keyword: Fuzzing, Fuzz Testing, NPM, NodeJs, JavaScript, JS, jsfuzz, Exception, npm
Рекомендации по теме