Fuzzing


aturt13 Dojo.

Identifying vulnerabilities in large codebases through manual means is both inefficient and time-consuming. As code length increases, complex interdependent elements hinder manual analysis. Race conditions and intricate heap corruption vulnerabilities can be oftentimes triggered only by a very complex sequence of actions. As human minds struggle to manually assess vast amounts of data, we can leverage computers and algorithms to do the hard work for us.

You might want to add the following to your shell init file:

export AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
export AFL_SKIP_CPUFREQ=1

THIS MODULE IS CURRENTLY IN DEVELOPMENT, SO IT IS ENTIRELY POSSIBLE THAT THE CHALLENGES ARE EITHER UNSOLVABLE OR DO NOT WORK.

I am currently trying to make the challenges more focused on fuzzing and less focused on exploiting, so levels level\d\.1 might not be exploitable. I will modify them in the future if that's the case.



Challenges

Leverage afl-fuzz and afl-clang-fast to find an input that causes the program to crash. You have the source code available.

Connect with SSH

Link your SSH key, then connect with: ssh hacker@pwn.college

Exploit the binary.

Connect with SSH

Link your SSH key, then connect with: ssh hacker@pwn.college

Use afl-fuzz with dictionaries to cause the program to crash.

Connect with SSH

Link your SSH key, then connect with: ssh hacker@pwn.college

Exploit the binary.

Connect with SSH

Link your SSH key, then connect with: ssh hacker@pwn.college

Let's see how you cope with a fuzzing-unfriendly program.

Connect with SSH

Link your SSH key, then connect with: ssh hacker@pwn.college

Exploit the binary.

Connect with SSH

Link your SSH key, then connect with: ssh hacker@pwn.college

What if you don't have source code?

Connect with SSH

Link your SSH key, then connect with: ssh hacker@pwn.college

Exploit the binary.

Connect with SSH

Link your SSH key, then connect with: ssh hacker@pwn.college

30-Day Scoreboard:

This scoreboard reflects solves for challenges in this module after the module launched in this dojo.

Rank Hacker Badges Score