Practical Web Browser Fuzzing
Patrick Ventuzelo & Tanguy Duhamel

Overview

Web browsers are among the most widely used and essential software globally. With millions of lines of code, they manage, sanitize, and interpret various types of untrusted web data. Given the complexity of these systems, which involve compilers, interpreters, and parsing libraries, it is inevitable that developers will introduce bugs. 

This training will focus on applying various fuzzing techniques to uncover critical vulnerabilities in different web browser implementations.

The course will start by providing you with the necessary background to understand modern web browser architecture and key components. You will then explore a straightforward testing environment designed for replaying, debugging, minimizing, and analyzing existing issues, CVEs, and PoCs. Through dedicated modules, you will learn to fuzz essential browser components like the DOM, JavaScript engines, JIT compilers, WebAssembly, and IPC. You will gain experience using well-known tools (such as Honggfuzz, Domato, Dharma, Fuzzilli, Afl++) and creating custom fuzzers to apply various techniques (coverage-guided, grammar-based, in-process fuzzing) to rediscover known vulnerabilities and potentially identify new ones.

This hands-on training focuses on real-world use cases and applies to Google Chrome, Firefox, and WebKit/JSC, ensuring you gain practical expertise. 

Topics Covered

Schedule

• Day 1
  • o Morning: Browser Internals and Fuzzing Basics (Module 1)
  • o Afternoon: Fuzzing DOM & Rendering Engines (Module 2)
• Day 2
  • o Morning: Fuzzing DOM & Rendering Engines (Module 2)
  • o Afternoon: Fuzzing JavaScript Engines & JIT Compilers (Module 3)
• Day 3
  • o Morning: Fuzzing JavaScript Engines & JIT Compilers (Module 3)
  • o Afternoon: Fuzzing WebAssembly Compilers & APIs (Module 4)
• Day 4
  • o Morning: Fuzzing WebAssembly Compilers & APIs (Module 4)
  • o Afternoon: Fuzzing IPC and Other Components (Module 5)

Bio