//Training
session>

Fuzzing is a powerful technique for identifying vulnerabilities in software. This hands-on training will cover the theory and practical aspects of fuzzing, including coverage-guided fuzzing, basic blocks and binary instrumentation, corpus collection and minimization, target selection, crash triage and root cause analysis, and real-life CVE analysis.

In this workshop, attendees will have the opportunity to practice fuzzing on Linux and windows platforms and apply the concepts and techniques learned in the training to fuzz real world software. The training will also showcase how can we customize WinAFL to add new features and suit our needs.

This training is suitable for attendees with a basic understanding of software development and testing and is beginner friendly.
This training will start from user mode fuzzing and later on covers topics like linux kernel fuzzing and firmware fuzzing etc.
In this training, attendees will also learn about the different types of vulnerabilities that can be found through fuzzing, including buffer overflows, heap overflows, integer overflows, use-after free errors, and out-of-bounds read/write errors. We will discuss the underlying causes and potential impacts of these vulnerabilities, as well as how to identify and address them through fuzzing. In addition to coverage-guided fuzzing, we will also introduce other types of fuzzer, such as dumb fuzzers and mutation fuzzers, and discuss their benefits and limitations. Attendees will also learn how to use tools such as GDB, WinDBG and Crashwalk to debug and analyse crashes, and to perform root cause analysis to identify the underlying cause of vulnerabilities. We will also see how to debug crashes using time travel debugging on windows, measure code coverage, collect corpus and minimise them.