Runtime Manipulation of Android and iOS Applications
Explore runtime analysis and manipulation techniques for mobile app security testing, focusing on tools for iOS and Android to enhance your mobile security toolbox.
How to Take Over a Production System in the Cloud
Explore real-world cloud security vulnerabilities, their root causes, and effective mitigation strategies through examples and demonstrations. Learn to protect your cloud systems from potential threats.
SkillDetective - Automated Policy-Violation Detection of Voice Assistant Applications in the Wild
Automated tool for detecting policy violations in voice assistant apps, analyzing 54,055 Alexa skills and 5,583 Google actions, identifying over 6,000 violations across 52 policy requirements.
T-Fuzz - Fuzzing by Program Transformation
Innovative fuzzing technique that removes input checks to explore deeper code paths, improving bug discovery in software. Combines program transformation with symbolic execution for effective results.
Angora - Efficient Fuzzing by Principled Search
Innovative fuzzing technique combining mutation-based speed with high-quality input generation, outperforming existing fuzzers in bug detection and branch coverage through advanced constraint-solving methods.
Hackers vs. Testers - A Comparison of Software Vulnerability Discovery Processes
Explore the processes, skills, and challenges of software testers and white-hat hackers in identifying security vulnerabilities, based on a comparative study of 25 professionals.
How the BIOS Assures Its Handling of Inputs
Explore BIOS input handling, firmware interfaces, and analysis techniques for formal validation and vulnerability detection, including static, dynamic, and symbolic execution approaches.
SymCerts - Practical Symbolic Execution for Exposing Noncompliance in X.509 Certificate Validation
Explore practical symbolic execution techniques to uncover noncompliance in X.509 certificate validation implementations, enhancing security in SSL/TLS protocols and IoT systems.
GRIMOIRE - Synthesizing Structure while Fuzzing
Innovative fuzzing technique for programs with structured inputs, synthesizing complex structures on-the-fly without pre-configuration, outperforming existing methods and uncovering 19 memory corruption bugs.
A Fuzzing and Protocol Analysis Case-Study of DNP3
Explores vulnerabilities in DNP3, a key SCADA protocol for power systems, revealing design flaws and implementation gaps. Discusses fuzzing results, CVEs, and analyzes the protocol's security addendum.
Protocol State Machines and Session Languages
Explores protocol state machines and session languages in security, discussing specification, implementation, and testing challenges. Proposes automated inference of formal specifications to improve security.
Program-Adaptive Mutational Fuzzing
Innovative algorithm maximizes bug detection in black-box mutational fuzzing by leveraging symbolic analysis to optimize mutation ratios, resulting in 38.6% more bugs found across 8 applications.
IRQDebloat - Reducing Driver Attack Surface in Embedded Devices
Explore techniques to reduce attack surfaces in embedded device drivers through IRQ debloating, binary analysis, and fuzzing. Learn about challenges, implementation, and evaluation methods.
Testing Database Engines via Pivoted Query Synthesis
Innovative approach to detect logic bugs in database systems using Pivoted Query Synthesis, demonstrating high effectiveness in finding and fixing issues in major DBMSs.
FuzzUSB - Hybrid Stateful Fuzzing of USB Gadget Stacks
Explore hybrid stateful fuzzing techniques for USB gadget stacks, enhancing security testing and vulnerability detection in USB device implementations.
K-Scheduler - Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis
Explore effective seed scheduling for fuzzing using graph centrality analysis, enhancing software testing efficiency and vulnerability detection.
BEACON - Directed Grey-Box Fuzzing with Provable Path Pruning
Explore advanced grey-box fuzzing techniques with provable path pruning, enhancing software testing efficiency and vulnerability detection in complex systems.
NEUZZ - Efficient Fuzzing with Neural Program Smoothing
Innovative fuzzing technique using neural networks to approximate program behavior, enabling more efficient bug discovery and higher code coverage in software testing.
Learning from Mutants - Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System
Innovative approach to automatically construct CPS models using supervised machine learning on data from systematically seeded software faults, demonstrating efficacy in detecting various attacks on a water purification plant simulator.
Jigsaw - Efficient and Scalable Path Constraints Fuzzing
Explore efficient and scalable path constraints fuzzing techniques with Jigsaw, enhancing software testing and vulnerability detection for improved system security and reliability.
One Engine to Fuzz 'em All - Generic Language Processor Testing with Semantic Validation
Explore innovative techniques for generic language processor testing, focusing on semantic validation to enhance fuzzing efficiency and effectiveness across diverse systems.