Vulnerability research | Fuzzing | Reversing | WebAssembly | Ethereum
2020/02/18 @ wasmer medium
In the last months I’ve been working developing fuzzing targets to find bugs and create patches for the Wasmer WebAssembly runtime.
In this post we will learn what is fuzzing, why it is important for WebAssembly runtimes and what kind of bugs fuzzing helped to detect.
2020/01/30 @ webassembly-security.com
In this short blogpost, I will first introduce jsfuzz, a coverage-guided fuzzer for javascript/nodejs packages. Then, I’ll discuss about the wasm binary parsing library I decided to target. Finally, I’ll explain how to create a jsfuzz target script and show the OOM/DoS crash I found.
2020/01/09 @ webassembly-security.com
In this blogpost, I will first detailed WebAssembly Javascript APIs supported by major browsers. Then, I’ll explains how to use Dharma to generate valid Javascript file to fuzz WebAssembly APIs. Finally, I’ll show an easy way to execute those generated testcases over ASAN build of Chrome/V8.