Finding Buffer Overflow with Fuzzing | Ep. 04

AFL helped us to find a buffer overflow. Did we find a real crash in sudo? Let's investigate it.

Episode 04:
00:00 - Intro
00:28 - Looking at AFL crashes
01:25 - Investigate Crashes with gdb
03:35 - Debug Crash in AFL argv[] wrapper
04:27 - Fixing Buffer Overflow in AFL argv[] wrapper
05:19 - Setup Fuzzing Experiment with AFL++
07:11 - AFL UI Output Information

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

[LunarLambda]

AFL finding a bug in AFL. The wonders of technology

[u-ux]

7:00 the image mirroring to match where you point to cracked me up for some stupid reason :D

[lukor-tech]

I love how other yt peeps put the ad in the middle of the video so you have to skip and all that and Chad LiveOverflow puts it at the end as a quick remark.

Great!

[andrewrichardson]

Back to your roots. Love the content. Even when you branch out into new things. Keep them coming. =] You are a great teacher.

[ムワ-dn]

last time we got some paper like "reversing ida pro keygen with ida pro", now we got fuzzing AFL with AFL ... nice

[peppiess]

Well good timing to check this out at the same time with diner.

[warker_de]

Thx for sharing those misses! IMHO this is much more valuable than .. I Fuzz .. I Found

[mmdts]

An issue with this video: When "grepping for sudoedit" to see if it found the bug at 1:12, REMEMBER that anything that ends in *edit works as well, so you should just grep for edit instead of sudoedit, such that if the fuzzer found something like "pwnedit", you'd know about it.

[ParamjitSingh-qbzn]

Hey I have a request. Can ya make a video on showcasing amazing bugs in Android 12 from google's reward program?

[oxidiezed]

5:19 the way you fixed it hurt my C knowledge

[userou-igze]

I might check out the last 5 min before watching the next afl adventure lol. If anything is clear from this it's that afl out of the box is an utter pain unless you're an expert from another universe (or you coded it). Thanks for the vid

[jakepanda]

Hi liveoverflow i run into a problem with AFL.If i use it in 4GB RAM and core-i3 machine is there any problem comes up if i continue my fuzzing with AFL. please answer because i am in great dilemma.

[schizotaku]

Is that bunny a reference to something?

[BassheadMusicConnoisseur]

Why do I even watch these videos, I only know higher lever languages like java, js frontend, python. Assembly is another level

[AliMShipleSYR]

am not fuzzing expert so am not going to talk a lot,
i will say that the half of what you said i understand,
i think more "sudo" crashes will be introduced in next years, if am not mistaken, most of crashes goes back to how c language compiler work, or how system goes in understanding binaries,
Keep the good work, i have been flowing you since you started the channel,
Ps:am also E. E. E 😂but we didn't dive in programming, pure EE,
with luck 🌹

[skynet.yousha]

I want to learn Binary exploitation from scratch, where should i start?

[creeperlolthetrouble]

How about a video just about clubmate?

[voxelfusion]

Installed doas.
Made an alias sudo="doas".
Where is your 0day now? lol

[sodiboo]

6:53 why not just flip the entire shot for those 30 seconds instead of only when you point wrong?

[mmesba]

How much knowledge I need to understand this video? I mean which terms. Please answer someone