Exposing Hidden Exploitable Behaviors In Programming Languages Using Differential Fuzzing

This paper reveals the most serious vulnerabilities found in each language. It includes practical examples identifying which undocumented functions could allow OS command execution, when sensitive file contents may be partially exposed in error messages, how native code is being unexpectedly interpreted – locally and remotely – and when constant's names could be used as regular strings for OS command execution.

By Fernando Arnaboldi