[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FVK2H67QB0K69AH9FN99T":3,"skill-same:01M71FVK2H67QB0K69AH9FN99T":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":14,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M71FVK2H67QB0K69AH9FN99T","offensive-exploit-dev-course",null,"- Ensure your environment is set up with debugging tools like GDB, WinDbg (for Windows), and other necessary utilities.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-exploit-dev-course\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000039","教师与教育","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"dev","offensive exploit dev course","exploit","offensive","course","Tools","Utilities","debugging tools","with","debugging","cybersecurity","up","environment","for","gdb","windows","SET","2026-11-10 10:12:30",false,"---\nname: offensive-exploit-dev-course\ndescription: \"- Ensure your environment is set up with debugging tools like GDB, WinDbg (for Windows), and other necessary utilities.\"\ndomain: cybersecurity\n---\n\n## Full Methodology\n\n# Exploit Development\n\n## Week 1: Foundations and Fuzzing Basics\n\n### Day 1: Introduction to Fuzzing\n\n- **Goal**: Understand the fundamentals of fuzzing and get hands-on experience with `AFL++`.\n- **Activities**:\n  - _Reading_: \"Fuzzing for Software Security Testing and Quality Assurance\" by `Ari Takanen`(From 1.3.2 to 1.3.8 and 2.4.1 to 2.7.5.7).\n  - _Online Resource_:\n    - [Fuzzing Book by `Andreas Zeller`](https:\u002F\u002Fwww.fuzzingbook.org\u002F) - Read \"Introduction\" and \"Fuzzing Basics.\"\n    - [`AFL++` Documentation](https:\u002F\u002Faflplus.plus\u002Fdocs\u002F) - Follow the quick start guide.\n    - [Interactive Module to Learn Fuzzing](https:\u002F\u002Fgithub.com\u002Falex-maleno\u002FFuzzing-Module.git)\n  - _Exercise_:\n    - Set up a Linux virtual machine (VM) with the necessary tools installed, including compilers and debuggers\n    - Run `AFL++` on a C program\n\n```bash\n# Setting up AFL++\nsudo apt install build-essential gcc-13-plugin-dev cpio python3-dev libcapstone-dev pkg-config libglib2.0-dev libpixman-1-dev automake autoconf python3-pip ninja-build cmake\nwget https:\u002F\u002Fapt.llvm.org\u002Fllvm.sh\nchmod +x llvm.sh\nsudo .\u002Fllvm.sh 19 all\ncurl --proto '=https' --tlsv1.2 -sSf \"https:\u002F\u002Fsh.rustup.rs\" | sh\nmkdir soft\ncd soft\ngit clone --branch dev --depth 1 https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\ncd AFLplusplus\nmake distrib\nsudo make install\n# Phase 1\ncd ~\u002F && mkdir tuts && cd tuts\ngit clone --branch main --depth 1 https:\u002F\u002Fgithub.com\u002Falex-maleno\u002FFuzzing-Module.git\ncd Fuzzing-Module\u002Fexercise1 && mkdir build && cd build\nCC=\u002Fusr\u002Flocal\u002Fbin\u002Fafl-clang-fast CXX=\u002Fusr\u002Flocal\u002Fbin\u002Fafl-clang-fast++ cmake ..\nmake && cd ..\u002F && mkdir seeds && cd seeds && for i in {0..4}; do dd if=\u002Fdev\u002Furandom of=seed_$i bs=64 count=10; done && cd ..\u002Fbuild\nafl-fuzz -i \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise1\u002Fseeds\u002F -o out -m none -d -- \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise1\u002Fbuild\u002Fsimple_crash\n# Phase 2\ncd \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise2 && mkdir build && cd build\nCC=\u002Fusr\u002Flocal\u002Fbin\u002Fafl-clang-lto CXX=\u002Fusr\u002Flocal\u002Fbin\u002Fafl-clang-lto++ cmake ..\nmake && cd ..\u002F && mkdir seeds && cd seeds && for i in {0..4}; do dd if=\u002Fdev\u002Furandom of=seed_$i bs=64 count=10; done && cd ..\u002Fbuild\nafl-fuzz -i \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise2\u002Fseeds\u002F -o out -m none -d -- \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise2\u002Fbuild\u002Fmedium\n```\n\n### Day 2: Continue Fuzzing with `AFL++`\n\n- **Goal**: Understand and apply advanced fuzzing techniques.\n- **Activities**:\n  - _Reading_: Continue with \"Fuzzing for Software Security Testing and Quality Assurance\" (From 3.3 to 3.9.8).\n  - _Exercise_:\n    - Experiment with different `AFL++` options (for example, dictionary-based fuzzing, persistent mode).\n    - Running `AFL++` with a real-world application like a file format parser to mimic real-world scenarios.\n\n```bash\ncd \u002Fhome\u002Fdev\u002Ftuts && git clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fdavisking\u002Fdlib.git\ncd dlib\u002Ftools\u002Fimglab && mkdir -p build && cd build && export AFL_USE_UBSAN=1 && export AFL_USE_ASAN=1\nexport ASAN_OPTIONS=\"detect_leaks=1:abort_on_error=1:allow_user_segv_handler=0:handle_abort=1:symbolize=0\"\nsudo apt install libx11-dev\ncmake -DCMAKE_C_COMPILER=afl-clang-fast -DDLIB_NO_GUI_SUPPORT=0 -DCMAKE_CXX_COMPILER=afl-clang-fast++ -DCMAKE_CXX_FLAGS=\"-fsanitize=address,leak,undefined -g\" -DCMAKE_C_FLAGS=\"-fsanitize=address,leak,undefined -g\" ..\nmake -j8 && mkdir -p fuzz\u002Fimage\u002Fin && cp \u002Fhome\u002Fdev\u002Ftuts\u002Fdlib\u002Fexamples\u002Ffaces\u002Ftesting.xml fuzz\u002Fimage\u002Fin\u002F\nafl-fuzz -i fuzz\u002Fimage\u002Fin -o fuzz\u002Fimage\u002Fout -M Master -- .\u002Fimglab --stats @@\nafl-fuzz -i fuzz\u002Fimage\u002Fin -o fuzz\u002Fimage\u002Fout -S Slave -- .\u002Fimglab --stats @@\nsudo apt install gdb\ngit clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fjfoote\u002Fexploitable.git ~\u002Fsoft\u002Fexploitable\ncd ~\u002Fsoft\u002Fexploitable && sudo python3 setup.py install\nwget -O ~\u002F.gdbinit-gef.py -q https:\u002F\u002Fgef.blah.cat\u002Fpy && echo source ~\u002F.gdbinit-gef.py >> ~\u002F.gdbinit\nsudo apt install valgrind\nafl-collect -d crashes.db -e gdb_script -r -rr .\u002Ffuzz\u002Fimage\u002Fout\u002FMaster .\u002Fafl-collect -j 8 -- .\u002Fimglab --stats @@%\n```\n\n### Day 3: Introduction to Google FuzzTest\n\n- **Goal**: Understand in-process fuzzing with FuzzTest.\n- **Activities**:\n  - _Reading_: Continue with \"Fuzzing for Software Security Testing and Quality Assurance\" (From 4.2.1 to 4.4).\n  - _Online Resource_: [Google FuzzTest](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzztest) - Follow the tutorial and examples.\n  - _Exercise_: Write a simple fuzz target using FuzzTest.\n\n```bash\ncd \u002Fhome\u002Fdev\u002Ftuts && mkdir first_fuzz_project && cd first_fuzz_project\ngit clone --branch main --depth 1 https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzztest.git\ncat \u003C\u003CEOT >> CMakeLists.txt\ncmake_minimum_required(VERSION 3.19)\nproject(first_fuzz_project)\n\n# GoogleTest requires at least C++17\nset(CMAKE_CXX_STANDARD 17)\n\nadd_subdirectory(fuzztest)\n\nenable_testing()\n\ninclude(GoogleTest)\nfuzztest_setup_fuzzing_flags()\nadd_executable(\n  first_fuzz_test\n  first_fuzz_test.cc\n)\n\nlink_fuzztest(first_fuzz_test)\ngtest_discover_tests(first_fuzz_test)\nEOT\ncat \u003C\u003CEOT >> first_fuzz_test.cc\n#include \"fuzztest\u002Ffuzztest.h\"\n#include \"gtest\u002Fgtest.h\"\n\nTEST(MyTestSuite, OnePlustTwoIsTwoPlusOne) {\n  EXPECT_EQ(1 + 2, 2 + 1);\n}\n\nvoid IntegerAdditionCommutes(int a, int b) {\n  EXPECT_EQ(a + b, b + a);\n}\nFUZZ_TEST(MyTestSuite, IntegerAdditionCommutes);\nEOT\nmkdir build && cd build\nCC=clang-18 CXX=clang++-18 cmake -DCMAKE_BUILD_TYPE=RelWithDebug -DFUZZTEST_FUZZING_MODE=on ..\nsudo apt install libssl-dev\ncmake --build .\n.\u002Ffirst_fuzz_test --fuzz=MyTestSuite.IntegerAdditionCommutes\n```\n\n### Day 4: Introduction to `HonggFuzz`\n\n- **Goal**: Understand Fuzz methods, types, ...\n- **Activities**:\n  - _Reading_: Continue with \"Fuzzing for Software Security Testing and Quality Assurance\" (From 5.1.2 to 5.3.7).\n  - _Online Resource_: [HongFuzz](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fhonggfuzz.git)\n  - _Exercise_: Fuzz OpenSSL server and private key\n\n```bash\ncd \u002Fhome\u002Fdev\u002Fsoft && git clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fhonggfuzz.git\nsudo apt-get install binutils-dev libunwind-dev libblocksruntime-dev clang\ncd honggfuzz && make && sudo make install\ncd \u002Fhome\u002Fdev\u002Ftuts && git clone --branch master --depth=1 https:\u002F\u002Fgithub.com\u002Fopenssl\u002Fopenssl.git\nmv openssl openssl-master && cd openssl-master\nCC=\u002Fusr\u002Flocal\u002Fbin\u002Fhfuzz-clang CXX=\"$CC\"++ .\u002Fconfig \\\n  -DPEDANTIC no-shared -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -O0 \\\n  -fno-sanitize=alignment -lm -ggdb -gdwarf-4 --debug -fno-omit-frame-pointer \\\n  enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 \\\n  enable-ssl3 enable-ssl3-method enable-nextprotoneg enable-heartbeats \\\n  enable-aria enable-zlib enable-egd enable-msan\nmake -j$(nproc)\ncat \u003C\u003CEOT >> make.sh\nset -x\nset -e\necho \"Building honggfuzz fuzzers\"\nfor x in x509 privkey client server; do\n        hfuzz-clang -DBORINGSSL_UNSAFE_DETERMINISTIC_MODE -DBORINGSSL_UNSAFE_FUZZER_MODE -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -DBN_DEBUG -DLIBRESSL_HAS_TLS1_3 \\\\\n        -O3 -g -DFuzzerInitialize=LLVMFuzzerInitialize -DFuzzerTestOneInput=LLVMFuzzerTestOneInput -I\u002Fhome\u002Fdev\u002Ftuts\u002Fopenssl-master\u002Finclude \\\\\n        -I\u002Fhome\u002Fdev\u002Fsoft\u002Fhonggfuzz\u002Fexamples\u002Fopenssl -I\u002Fhome\u002Fdev\u002Fsoft\u002Fhonggfuzz -g \"\u002Fhome\u002Fdev\u002Fsoft\u002Fhonggfuzz\u002Fexamples\u002Fopenssl\u002F\\$x.c\" -o \"libfuzzer.openssl-mastermemory.\\$x\" \\\\\n        .\u002Flibssl.a .\u002Flibcrypto.a -lpthread -lz -ldl -fsanitize=\\$1\ndone\nEOT\nbash make.sh memory\nhonggfuzz --input ~\u002Fsoft\u002Fhonggfuzz\u002Fexamples\u002Fopenssl\u002Fcorpus_server\u002F -- .\u002Flibfuzzer.openssl-mastermemory.server\nhonggfuzz --input ~\u002Fsoft\u002Fhonggfuzz\u002Fexamples\u002Fopenssl\u002Fcorpus_privkey\u002F -- .\u002Flibfuzzer.openssl-mastermemory.privkey\n```\n\n### Day 5: Introduction to `Syzkaller`\n\n- **Goal**: Begin kernel fuzzing with `Syzkaller`.\n- **Activities**:\n  - _Tool_: Install `Syzkaller` on a Linux VM.\n  - _Online Resource_: [`Syzkaller` Documentation](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsyzkaller\u002Fblob\u002Fmaster\u002Fdocs\u002Flinux\u002Fsetup_ubuntu-host_qemu-vm_x86-64-kernel.md)\n  - _Exercise_: Start fuzzing the Linux kernel with `Syzkaller`.\n\n```bash\nsudo apt update\nsudo apt install make gcc flex bison libncurses-dev libelf-dev libssl-dev\ncd ~\u002Fsoft && git clone --branch v6.11 --depth 1 git:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git kernel\ncd kernel && make defconfig && make kvm_guest.config\nvim .config\n# Edit these inside .config file\n#CONFIG_KCOV=y\n#CONFIG_DEBUG_INFO_DWARF4=y\n#CONFIG_KASAN=y\n#CONFIG_KASAN_INLINE=y\n#CONFIG_CONFIGFS_FS=y\n#CONFIG_SECURITYFS=y\n#CONFIG_CMDLINE_BOOL=y\n#CONFIG_CMDLINE=\"net.ifnames=0\"\nmake olddefconfig && make -j`nproc`\nsudo apt install debootstrap\nmkdir ~\u002Fsoft\u002Fimage && cd ~\u002Fsoft\u002Fimage\nwget https:\u002F\u002Fraw.githubusercontent.com\u002Fgoogle\u002Fsyzkaller\u002Fmaster\u002Ftools\u002Fcreate-image.sh -O create-image.sh\nchmod +x create-image.sh && .\u002Fcreate-image.sh --distribution trixie --feature full\nsudo apt install qemu-system-x86\ncd \u002Ftmp\u002F && sudo qemu-system-x86_64 \\\n\t-m 2G -smp 2 -kernel ~\u002Fsoft\u002Fkernel\u002Farch\u002Fx86\u002Fboot\u002FbzImage \\\n\t-append \"console=ttyS0 root=\u002Fdev\u002Fsda earlyprintk=serial net.ifnames=0\" \\\n\t-drive file=\u002Fhome\u002Fdev\u002Fsoft\u002Fimage\u002Ftrixie.img,format=raw \\\n\t-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \\\n\t-net nic,model=e1000 -enable-kvm -nographic \\\n\t-pidfile vm.pid 2>&1 | tee vm.log\n# ssh to QEMU instance in another terminal.\nssh -i ~\u002Fsoft\u002Fimage\u002Ftrixie.id_rsa -p 10021 -o \"StrictHostKeyChecking no\" root@localhost\nwget https:\u002F\u002Fdl.google.com\u002Fgo\u002Fgo1.23.3.linux-amd64.tar.gz\ntar -xf go1.23.3.linux-amd64.tar.gz && sudo mv go \u002Fusr\u002Flocal\ncd ~\u002Fsoft\u002F && git clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsyzkaller\ncd syzkaller && export PATH=$PATH:\u002Fusr\u002Flocal\u002Fgo\u002Fbin && make\ncat \u003C\u003CEOT >> my.cfg\n{\n\t\"target\": \"linux\u002Famd64\",\n\t\"http\": \"127.0.0.1:56741\",\n\t\"workdir\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fsyzkaller\u002Fworkdir\",\n\t\"kernel_obj\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fkernel\",\n\t\"image\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fimage\u002Ftrixie.img\",\n\t\"sshkey\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fimage\u002Ftrixie.id_rsa\",\n\t\"syzkaller\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fsyzkaller\",\n\t\"procs\": 8,\n\t\"type\": \"qemu\",\n\t\"vm\": {\n\t\t\"count\": 4,\n\t\t\"kernel\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fkernel\u002Farch\u002Fx86\u002Fboot\u002FbzImage\",\n\t\t\"cmdline\": \"net.ifnames=0\",\n\t\t\"cpu\": 2,\n\t\t\"mem\": 2048\n\t}\n}\nEOT\nmkdir workdir && sudo .\u002Fbin\u002Fsyz-manager -config=\u002Fhome\u002Fdev\u002Fsoft\u002Fsyzkaller\u002Fmy.cfg\nsudo apt install w3m w3m-img && w3m http:\u002F\u002F127.0.0.1:56741\n```\n\n### Day 6: Analyzing Fuzzing Outputs\n\n- **Goal**: Learn how to analyze and triage fuzzing outputs to identify unique crashes and potential vulnerabilities.\n- **Activities**:\n  - **Reading**:\n    - _Book_: \"Fuzzing for Software Security Testing and Quality Assurance\" by `Ari Takanen` (Sections 6.1 to 6.5).\n    - _Article_: [Understanding Fuzzing and How It Discovers Security Flaws](https:\u002F\u002Fwww.synopsys.com\u002Fblogs\u002Fsoftware-security\u002Fwhat-is-fuzz-testing\u002F)\n  - **Online Resources**:\n    - [AddressSanitizer Documentation](https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FAddressSanitizer.html)\n    - [GDB Python API](https:\u002F\u002Fsourceware.org\u002Fgdb\u002Fonlinedocs\u002Fgdb\u002FPython-API.html)\n    - [Exploitable Crash Analyzer](https:\u002F\u002Fgithub.com\u002Fjfoote\u002Fexploitable)\n  - **Exercise**:\n    - **Set Up Crash Analysis Tools**:\n      - Install GDB and the `exploitable` plugin for crash classification.\n      - Ensure AddressSanitizer is set up for detailed memory error reports.\n    - **Collect and Triage Crashes**:\n      - Use crashes from previous fuzzing sessions with `AFL++`, `HonggFuzz`, or `Syzkaller`.\n      - Deduplicate crashes to focus on unique issues.\n    - **Analyze Crashes**:\n      - Use GDB and AddressSanitizer to investigate the root cause of each crash.\n      - Classify the crashes based on severity and `exploitability`.\n    - **Automate Crash Analysis**:\n      - Write a script to automate the analysis of multiple crash files.\n    - **Deduplicate Crashes**:\n      - Use stack traces or tools like `afl-collect` to identify unique crashes.\n    - **Document Findings**:\n      - Create a report summarizing each unique crash, including:\n        - The input that caused the crash.\n        - The type of vulnerability (buffer overflow, null pointer de-reference,...).\n        - Potential impact and severity.\n    - **Optional**:\n      - Explore other sanitizers like UndefinedBehaviorSanitizer (`UBSan`) for additional checks.\n- **Discussion Points**:\n  - The importance of accurately triaging crashes to prioritize security fixes.\n  - Understanding false positives and how to filter them out.\n  - The role of sanitizers in providing detailed diagnostics.\n- **Tips**:\n  - Always test crashes in a controlled environment to prevent unintended effects.\n  - Keep your analysis tools up to date for the best results.\n  - Collaborate with your team to verify findings and discuss mitigation strategies.\n- **Reflection**:\n  - How does effective crash analysis improve the overall security posture of software?\n  - What challenges did you face during crash analysis, and how did you overcome them?\n\n```bash\n# Install required tools\nsudo apt update\nsudo apt install gdb python3-pip\n\n# Install 'exploitable' GDB plugin\ngit clone https:\u002F\u002Fgithub.com\u002Fjfoote\u002Fexploitable.git\ncd exploitable\nsudo python3 setup.py install\n\n# Ensure AddressSanitizer is available (comes with Clang)\nwhich clang\n# If not installed, install Clang\nsudo apt install clang\n\n# Set up environment variables for AddressSanitizer\nexport ASAN_SYMBOLIZER_PATH=$(which llvm-symbolizer)\nexport ASAN_OPTIONS=symbolize=1:abort_on_error=1\n\n# Compile a target program with AddressSanitizer\ncd ~\u002Ftuts\u002F && git clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fhardik05\u002FDamn_Vulnerable_C_Program vuln\n# change int main(char *argv,int argc) to int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)\n# use size instead of argc and data instead of argv\ncd vuln && echo \"IMG\" > crash_input && clang -g -O1 -fsanitize=address,fuzzer -o target_asan dvcp.c\n\n# Example: Analyze a crash using GDB and 'exploitable'\ngdb -ex \"run \u003C crash_input\" \\\n    -ex \"exploitable\" \\\n    -ex \"quit\" --args .\u002Ftarget_asan\n# Script to automate crash analysis\nmkdir analyzed_crashes\nfor crash in crash-*; do\n    echo \"Analyzing $crash\"\n    gdb -batch -ex \"run \u003C $crash\" \\\n        -ex \"exploitable\" \\\n        --args .\u002Ftarget_asan &> analyzed_crashes\u002F$(basename $crash).log\ndone\n\ncurl --proto '=https' --tlsv1.2 -sSf \"https:\u002F\u002Fsh.rustup.rs\" | sh\ncargo install casr\ncasr-san -o asan.casrep -- .\u002Ftest_asan_df\n\n# Install afl-collect if using AFL++\nsudo apt install afl-utils\n\n# Collect and deduplicate crashes\nafl-collect -rr --crashdir crashes_deduped \\\n            --workdir afl_output -j 4 \\\n            -- .\u002Ftarget_asan @@\n# Compile with UBSan\nclang -g -O1 -fsanitize=undefined -o target_ubsan target.c\n```\n\n### Day 7: Review and Recap\n\n- **Goal**: Consolidate the knowledge gained during Week 1 by reviewing key concepts, clarifying doubts, and reinforcing practical skills in fuzzing and, initial crash analysis.\n- **Activities**:\n  - **Review Session**:\n    - Revisit the key concepts from Days 1 to 6:\n      - Fundamentals of fuzzing and its importance in security testing.\n      - Hands-on experience with fuzzing tools: `AFL++`, `FuzzTest`, `HonggFuzz`, and `Syzkaller`.\n      - Setting up fuzzing environments and running basic to advanced fuzzing campaigns.\n      - Initial crash analysis and triaging techniques.\n    - Discuss any challenges faced during the exercises and share solutions.\n  - **Reading**:\n    - _Summary Articles_:\n      - [A Brief History of Fuzzing](https:\u002F\u002Fwww.oreilly.com\u002Flibrary\u002Fview\u002Ffuzzing-for-software\u002F9780596554024\u002Fch01.html)\n      - [Best Practices in Fuzzing](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FFuzzing)\n    - _Documentation_:\n      - Revisit the documentation for the tools used to reinforce understanding of their features and options.\n  - **Knowledge Check**:\n    - **Quiz**:\n      - Prepare a set of questions to test your understanding of the week's material.\n        - What are the main differences between `AFL++` and `HonggFuzz`?\n        - How does in-process fuzzing with `FuzzTest` differ from traditional fuzzing methods?\n        - Explain the purpose of sanitizers like AddressSanitizer in fuzzing campaigns.\n        - Describe the process of setting up `Syzkaller` for kernel fuzzing.\n    - **Flashcards**:\n      - Create flashcards for important terms and concepts, such as:\n        - Mutation-based fuzzing\n        - Coverage-guided fuzzing\n        - Sanitizers\n        - Crash triaging\n        - Deduplication of crashes\n  - **Hands-On Practice**:\n    - **Consolidate Exercises**:\n      - Re-run previous fuzzing sessions with additional configurations to reinforce learning.\n      - Try fuzzing a new simple application using the tools you've learned.\n    - **Collaborative Learning**:\n      - If possible, discuss with peers or online communities about your findings and methodologies.\n      - Share your crash analysis reports and get feedback.\n  - **Deep Dive into Topics of Interest**:\n    - Choose a topic or tool from the week that you found most challenging or interesting and spend extra time exploring it.\n      - For example, delve deeper into `Syzkaller`'s syscall descriptions or explore advanced options in `AFL++`.\n- **Discussion Points**:\n  - **Challenges and Solutions**:\n    - Reflect on any obstacles you faced during the exercises.\n    - Discuss strategies for overcoming common issues in fuzzing campaigns, such as dealing with large numbers of crashes or configuring complex tools.\n  - **Real-World Applications**:\n    - Consider how the fuzzing techniques learned can be applied to real-world software projects.\n    - Discuss the impact of effective fuzzing on software security and quality assurance.\n- **Tips**:\n  - **Documentation and Note-Taking**:\n    - Maintain detailed notes of your configurations, commands used, and observations from your fuzzing sessions.\n    - Document any anomalies or unexpected behavior for future reference.\n  - **Tool Mastery**:\n    - Familiarize yourself with the command-line options and configurations of each tool.\n    - Practice writing custom scripts to automate repetitive tasks in your fuzzing workflow.\n- **Reflection**:\n  - **Self-Assessment**:\n    - Evaluate your understanding of the week's material.\n    - Identify areas where you feel confident and areas that may require additional study.\n  - **Goal Setting**:\n    - Set specific objectives for the next week based on your reflection.\n    - For example, aim to understand advanced features of a particular fuzzing tool or improve your crash analysis skills.\n- **Optional Activity**:\n  - **Beginner's Capture the Flag (CTF)**:\n    - Participate in a beginner-level CTF that focuses on binary exploitation and fuzzing challenges.\n    - Apply the skills you've learned in a competitive and practical environment.\n- **Additional Resources**:\n  - **Books**:\n    - _\"The Art of Software Security Assessment\"_ by Mark Dowd, John McDonald, and Justin Schuh – Chapters on fuzzing and vulnerability discovery.\n  - **Online Courses**:\n    - [Coursera: Software Security](https:\u002F\u002Fwww.coursera.org\u002Flearn\u002Fsoftware-security) – Sections related to input validation and fuzz testing.\n- **Action Items for Next Week**:\n  - Prepare for Week 2, which focuses on Crash Analysis.\n  - Ensure your environment is set up with debugging tools like GDB, WinDbg (for Windows), and other necessary utilities.\n\n## Week 2: Crash Analysis\n","## Full Methodology\n\n# Exploit Development\n\n## Week 1: Foundations and Fuzzing Basics\n\n### Day 1: Introduction to Fuzzing\n\n- **Goal**: Understand the fundamentals of fuzzing and get hands-on experience with `AFL++`.\n- **Activities**:\n  - _Reading_: \"Fuzzing for Software Security Testing and Quality Assurance\" by `Ari Takanen`(From 1.3.2 to 1.3.8 and 2.4.1 to 2.7.5.7).\n  - _Online Resource_:\n    - [Fuzzing Book by `Andreas Zeller`](https:\u002F\u002Fwww.fuzzingbook.org\u002F) - Read \"Introduction\" and \"Fuzzing Basics.\"\n    - [`AFL++` Documentation](https:\u002F\u002Faflplus.plus\u002Fdocs\u002F) - Follow the quick start guide.\n    - [Interactive Module to Learn Fuzzing](https:\u002F\u002Fgithub.com\u002Falex-maleno\u002FFuzzing-Module.git)\n  - _Exercise_:\n    - Set up a Linux virtual machine (VM) with the necessary tools installed, including compilers and debuggers\n    - Run `AFL++` on a C program\n\n```bash\n# Setting up AFL++\nsudo apt install build-essential gcc-13-plugin-dev cpio python3-dev libcapstone-dev pkg-config libglib2.0-dev libpixman-1-dev automake autoconf python3-pip ninja-build cmake\nwget https:\u002F\u002Fapt.llvm.org\u002Fllvm.sh\nchmod +x llvm.sh\nsudo .\u002Fllvm.sh 19 all\ncurl --proto '=https' --tlsv1.2 -sSf \"https:\u002F\u002Fsh.rustup.rs\" | sh\nmkdir soft\ncd soft\ngit clone --branch dev --depth 1 https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\ncd AFLplusplus\nmake distrib\nsudo make install\n# Phase 1\ncd ~\u002F && mkdir tuts && cd tuts\ngit clone --branch main --depth 1 https:\u002F\u002Fgithub.com\u002Falex-maleno\u002FFuzzing-Module.git\ncd Fuzzing-Module\u002Fexercise1 && mkdir build && cd build\nCC=\u002Fusr\u002Flocal\u002Fbin\u002Fafl-clang-fast CXX=\u002Fusr\u002Flocal\u002Fbin\u002Fafl-clang-fast++ cmake ..\nmake && cd ..\u002F && mkdir seeds && cd seeds && for i in {0..4}; do dd if=\u002Fdev\u002Furandom of=seed_$i bs=64 count=10; done && cd ..\u002Fbuild\nafl-fuzz -i \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise1\u002Fseeds\u002F -o out -m none -d -- \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise1\u002Fbuild\u002Fsimple_crash\n# Phase 2\ncd \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise2 && mkdir build && cd build\nCC=\u002Fusr\u002Flocal\u002Fbin\u002Fafl-clang-lto CXX=\u002Fusr\u002Flocal\u002Fbin\u002Fafl-clang-lto++ cmake ..\nmake && cd ..\u002F && mkdir seeds && cd seeds && for i in {0..4}; do dd if=\u002Fdev\u002Furandom of=seed_$i bs=64 count=10; done && cd ..\u002Fbuild\nafl-fuzz -i \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise2\u002Fseeds\u002F -o out -m none -d -- \u002Fhome\u002Fdev\u002Ftuts\u002FFuzzing-Module\u002Fexercise2\u002Fbuild\u002Fmedium\n```\n\n### Day 2: Continue Fuzzing with `AFL++`\n\n- **Goal**: Understand and apply advanced fuzzing techniques.\n- **Activities**:\n  - _Reading_: Continue with \"Fuzzing for Software Security Testing and Quality Assurance\" (From 3.3 to 3.9.8).\n  - _Exercise_:\n    - Experiment with different `AFL++` options (for example, dictionary-based fuzzing, persistent mode).\n    - Running `AFL++` with a real-world application like a file format parser to mimic real-world scenarios.\n\n```bash\ncd \u002Fhome\u002Fdev\u002Ftuts && git clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fdavisking\u002Fdlib.git\ncd dlib\u002Ftools\u002Fimglab && mkdir -p build && cd build && export AFL_USE_UBSAN=1 && export AFL_USE_ASAN=1\nexport ASAN_OPTIONS=\"detect_leaks=1:abort_on_error=1:allow_user_segv_handler=0:handle_abort=1:symbolize=0\"\nsudo apt install libx11-dev\ncmake -DCMAKE_C_COMPILER=afl-clang-fast -DDLIB_NO_GUI_SUPPORT=0 -DCMAKE_CXX_COMPILER=afl-clang-fast++ -DCMAKE_CXX_FLAGS=\"-fsanitize=address,leak,undefined -g\" -DCMAKE_C_FLAGS=\"-fsanitize=address,leak,undefined -g\" ..\nmake -j8 && mkdir -p fuzz\u002Fimage\u002Fin && cp \u002Fhome\u002Fdev\u002Ftuts\u002Fdlib\u002Fexamples\u002Ffaces\u002Ftesting.xml fuzz\u002Fimage\u002Fin\u002F\nafl-fuzz -i fuzz\u002Fimage\u002Fin -o fuzz\u002Fimage\u002Fout -M Master -- .\u002Fimglab --stats @@\nafl-fuzz -i fuzz\u002Fimage\u002Fin -o fuzz\u002Fimage\u002Fout -S Slave -- .\u002Fimglab --stats @@\nsudo apt install gdb\ngit clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fjfoote\u002Fexploitable.git ~\u002Fsoft\u002Fexploitable\ncd ~\u002Fsoft\u002Fexploitable && sudo python3 setup.py install\nwget -O ~\u002F.gdbinit-gef.py -q https:\u002F\u002Fgef.blah.cat\u002Fpy && echo source ~\u002F.gdbinit-gef.py >> ~\u002F.gdbinit\nsudo apt install valgrind\nafl-collect -d crashes.db -e gdb_script -r -rr .\u002Ffuzz\u002Fimage\u002Fout\u002FMaster .\u002Fafl-collect -j 8 -- .\u002Fimglab --stats @@%\n```\n\n### Day 3: Introduction to Google FuzzTest\n\n- **Goal**: Understand in-process fuzzing with FuzzTest.\n- **Activities**:\n  - _Reading_: Continue with \"Fuzzing for Software Security Testing and Quality Assurance\" (From 4.2.1 to 4.4).\n  - _Online Resource_: [Google FuzzTest](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzztest) - Follow the tutorial and examples.\n  - _Exercise_: Write a simple fuzz target using FuzzTest.\n\n```bash\ncd \u002Fhome\u002Fdev\u002Ftuts && mkdir first_fuzz_project && cd first_fuzz_project\ngit clone --branch main --depth 1 https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzztest.git\ncat \u003C\u003CEOT >> CMakeLists.txt\ncmake_minimum_required(VERSION 3.19)\nproject(first_fuzz_project)\n\n# GoogleTest requires at least C++17\nset(CMAKE_CXX_STANDARD 17)\n\nadd_subdirectory(fuzztest)\n\nenable_testing()\n\ninclude(GoogleTest)\nfuzztest_setup_fuzzing_flags()\nadd_executable(\n  first_fuzz_test\n  first_fuzz_test.cc\n)\n\nlink_fuzztest(first_fuzz_test)\ngtest_discover_tests(first_fuzz_test)\nEOT\ncat \u003C\u003CEOT >> first_fuzz_test.cc\n#include \"fuzztest\u002Ffuzztest.h\"\n#include \"gtest\u002Fgtest.h\"\n\nTEST(MyTestSuite, OnePlustTwoIsTwoPlusOne) {\n  EXPECT_EQ(1 + 2, 2 + 1);\n}\n\nvoid IntegerAdditionCommutes(int a, int b) {\n  EXPECT_EQ(a + b, b + a);\n}\nFUZZ_TEST(MyTestSuite, IntegerAdditionCommutes);\nEOT\nmkdir build && cd build\nCC=clang-18 CXX=clang++-18 cmake -DCMAKE_BUILD_TYPE=RelWithDebug -DFUZZTEST_FUZZING_MODE=on ..\nsudo apt install libssl-dev\ncmake --build .\n.\u002Ffirst_fuzz_test --fuzz=MyTestSuite.IntegerAdditionCommutes\n```\n\n### Day 4: Introduction to `HonggFuzz`\n\n- **Goal**: Understand Fuzz methods, types, ...\n- **Activities**:\n  - _Reading_: Continue with \"Fuzzing for Software Security Testing and Quality Assurance\" (From 5.1.2 to 5.3.7).\n  - _Online Resource_: [HongFuzz](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fhonggfuzz.git)\n  - _Exercise_: Fuzz OpenSSL server and private key\n\n```bash\ncd \u002Fhome\u002Fdev\u002Fsoft && git clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fhonggfuzz.git\nsudo apt-get install binutils-dev libunwind-dev libblocksruntime-dev clang\ncd honggfuzz && make && sudo make install\ncd \u002Fhome\u002Fdev\u002Ftuts && git clone --branch master --depth=1 https:\u002F\u002Fgithub.com\u002Fopenssl\u002Fopenssl.git\nmv openssl openssl-master && cd openssl-master\nCC=\u002Fusr\u002Flocal\u002Fbin\u002Fhfuzz-clang CXX=\"$CC\"++ .\u002Fconfig \\\n  -DPEDANTIC no-shared -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -O0 \\\n  -fno-sanitize=alignment -lm -ggdb -gdwarf-4 --debug -fno-omit-frame-pointer \\\n  enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 \\\n  enable-ssl3 enable-ssl3-method enable-nextprotoneg enable-heartbeats \\\n  enable-aria enable-zlib enable-egd enable-msan\nmake -j$(nproc)\ncat \u003C\u003CEOT >> make.sh\nset -x\nset -e\necho \"Building honggfuzz fuzzers\"\nfor x in x509 privkey client server; do\n        hfuzz-clang -DBORINGSSL_UNSAFE_DETERMINISTIC_MODE -DBORINGSSL_UNSAFE_FUZZER_MODE -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -DBN_DEBUG -DLIBRESSL_HAS_TLS1_3 \\\\\n        -O3 -g -DFuzzerInitialize=LLVMFuzzerInitialize -DFuzzerTestOneInput=LLVMFuzzerTestOneInput -I\u002Fhome\u002Fdev\u002Ftuts\u002Fopenssl-master\u002Finclude \\\\\n        -I\u002Fhome\u002Fdev\u002Fsoft\u002Fhonggfuzz\u002Fexamples\u002Fopenssl -I\u002Fhome\u002Fdev\u002Fsoft\u002Fhonggfuzz -g \"\u002Fhome\u002Fdev\u002Fsoft\u002Fhonggfuzz\u002Fexamples\u002Fopenssl\u002F\\$x.c\" -o \"libfuzzer.openssl-mastermemory.\\$x\" \\\\\n        .\u002Flibssl.a .\u002Flibcrypto.a -lpthread -lz -ldl -fsanitize=\\$1\ndone\nEOT\nbash make.sh memory\nhonggfuzz --input ~\u002Fsoft\u002Fhonggfuzz\u002Fexamples\u002Fopenssl\u002Fcorpus_server\u002F -- .\u002Flibfuzzer.openssl-mastermemory.server\nhonggfuzz --input ~\u002Fsoft\u002Fhonggfuzz\u002Fexamples\u002Fopenssl\u002Fcorpus_privkey\u002F -- .\u002Flibfuzzer.openssl-mastermemory.privkey\n```\n\n### Day 5: Introduction to `Syzkaller`\n\n- **Goal**: Begin kernel fuzzing with `Syzkaller`.\n- **Activities**:\n  - _Tool_: Install `Syzkaller` on a Linux VM.\n  - _Online Resource_: [`Syzkaller` Documentation](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsyzkaller\u002Fblob\u002Fmaster\u002Fdocs\u002Flinux\u002Fsetup_ubuntu-host_qemu-vm_x86-64-kernel.md)\n  - _Exercise_: Start fuzzing the Linux kernel with `Syzkaller`.\n\n```bash\nsudo apt update\nsudo apt install make gcc flex bison libncurses-dev libelf-dev libssl-dev\ncd ~\u002Fsoft && git clone --branch v6.11 --depth 1 git:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Ftorvalds\u002Flinux.git kernel\ncd kernel && make defconfig && make kvm_guest.config\nvim .config\n# Edit these inside .config file\n#CONFIG_KCOV=y\n#CONFIG_DEBUG_INFO_DWARF4=y\n#CONFIG_KASAN=y\n#CONFIG_KASAN_INLINE=y\n#CONFIG_CONFIGFS_FS=y\n#CONFIG_SECURITYFS=y\n#CONFIG_CMDLINE_BOOL=y\n#CONFIG_CMDLINE=\"net.ifnames=0\"\nmake olddefconfig && make -j`nproc`\nsudo apt install debootstrap\nmkdir ~\u002Fsoft\u002Fimage && cd ~\u002Fsoft\u002Fimage\nwget https:\u002F\u002Fraw.githubusercontent.com\u002Fgoogle\u002Fsyzkaller\u002Fmaster\u002Ftools\u002Fcreate-image.sh -O create-image.sh\nchmod +x create-image.sh && .\u002Fcreate-image.sh --distribution trixie --feature full\nsudo apt install qemu-system-x86\ncd \u002Ftmp\u002F && sudo qemu-system-x86_64 \\\n\t-m 2G -smp 2 -kernel ~\u002Fsoft\u002Fkernel\u002Farch\u002Fx86\u002Fboot\u002FbzImage \\\n\t-append \"console=ttyS0 root=\u002Fdev\u002Fsda earlyprintk=serial net.ifnames=0\" \\\n\t-drive file=\u002Fhome\u002Fdev\u002Fsoft\u002Fimage\u002Ftrixie.img,format=raw \\\n\t-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \\\n\t-net nic,model=e1000 -enable-kvm -nographic \\\n\t-pidfile vm.pid 2>&1 | tee vm.log\n# ssh to QEMU instance in another terminal.\nssh -i ~\u002Fsoft\u002Fimage\u002Ftrixie.id_rsa -p 10021 -o \"StrictHostKeyChecking no\" root@localhost\nwget https:\u002F\u002Fdl.google.com\u002Fgo\u002Fgo1.23.3.linux-amd64.tar.gz\ntar -xf go1.23.3.linux-amd64.tar.gz && sudo mv go \u002Fusr\u002Flocal\ncd ~\u002Fsoft\u002F && git clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fsyzkaller\ncd syzkaller && export PATH=$PATH:\u002Fusr\u002Flocal\u002Fgo\u002Fbin && make\ncat \u003C\u003CEOT >> my.cfg\n{\n\t\"target\": \"linux\u002Famd64\",\n\t\"http\": \"127.0.0.1:56741\",\n\t\"workdir\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fsyzkaller\u002Fworkdir\",\n\t\"kernel_obj\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fkernel\",\n\t\"image\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fimage\u002Ftrixie.img\",\n\t\"sshkey\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fimage\u002Ftrixie.id_rsa\",\n\t\"syzkaller\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fsyzkaller\",\n\t\"procs\": 8,\n\t\"type\": \"qemu\",\n\t\"vm\": {\n\t\t\"count\": 4,\n\t\t\"kernel\": \"\u002Fhome\u002Fdev\u002Fsoft\u002Fkernel\u002Farch\u002Fx86\u002Fboot\u002FbzImage\",\n\t\t\"cmdline\": \"net.ifnames=0\",\n\t\t\"cpu\": 2,\n\t\t\"mem\": 2048\n\t}\n}\nEOT\nmkdir workdir && sudo .\u002Fbin\u002Fsyz-manager -config=\u002Fhome\u002Fdev\u002Fsoft\u002Fsyzkaller\u002Fmy.cfg\nsudo apt install w3m w3m-img && w3m http:\u002F\u002F127.0.0.1:56741\n```\n\n### Day 6: Analyzing Fuzzing Outputs\n\n- **Goal**: Learn how to analyze and triage fuzzing outputs to identify unique crashes and potential vulnerabilities.\n- **Activities**:\n  - **Reading**:\n    - _Book_: \"Fuzzing for Software Security Testing and Quality Assurance\" by `Ari Takanen` (Sections 6.1 to 6.5).\n    - _Article_: [Understanding Fuzzing and How It Discovers Security Flaws](https:\u002F\u002Fwww.synopsys.com\u002Fblogs\u002Fsoftware-security\u002Fwhat-is-fuzz-testing\u002F)\n  - **Online Resources**:\n    - [AddressSanitizer Documentation](https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FAddressSanitizer.html)\n    - [GDB Python API](https:\u002F\u002Fsourceware.org\u002Fgdb\u002Fonlinedocs\u002Fgdb\u002FPython-API.html)\n    - [Exploitable Crash Analyzer](https:\u002F\u002Fgithub.com\u002Fjfoote\u002Fexploitable)\n  - **Exercise**:\n    - **Set Up Crash Analysis Tools**:\n      - Install GDB and the `exploitable` plugin for crash classification.\n      - Ensure AddressSanitizer is set up for detailed memory error reports.\n    - **Collect and Triage Crashes**:\n      - Use crashes from previous fuzzing sessions with `AFL++`, `HonggFuzz`, or `Syzkaller`.\n      - Deduplicate crashes to focus on unique issues.\n    - **Analyze Crashes**:\n      - Use GDB and AddressSanitizer to investigate the root cause of each crash.\n      - Classify the crashes based on severity and `exploitability`.\n    - **Automate Crash Analysis**:\n      - Write a script to automate the analysis of multiple crash files.\n    - **Deduplicate Crashes**:\n      - Use stack traces or tools like `afl-collect` to identify unique crashes.\n    - **Document Findings**:\n      - Create a report summarizing each unique crash, including:\n        - The input that caused the crash.\n        - The type of vulnerability (buffer overflow, null pointer de-reference,...).\n        - Potential impact and severity.\n    - **Optional**:\n      - Explore other sanitizers like UndefinedBehaviorSanitizer (`UBSan`) for additional checks.\n- **Discussion Points**:\n  - The importance of accurately triaging crashes to prioritize security fixes.\n  - Understanding false positives and how to filter them out.\n  - The role of sanitizers in providing detailed diagnostics.\n- **Tips**:\n  - Always test crashes in a controlled environment to prevent unintended effects.\n  - Keep your analysis tools up to date for the best results.\n  - Collaborate with your team to verify findings and discuss mitigation strategies.\n- **Reflection**:\n  - How does effective crash analysis improve the overall security posture of software?\n  - What challenges did you face during crash analysis, and how did you overcome them?\n\n```bash\n# Install required tools\nsudo apt update\nsudo apt install gdb python3-pip\n\n# Install 'exploitable' GDB plugin\ngit clone https:\u002F\u002Fgithub.com\u002Fjfoote\u002Fexploitable.git\ncd exploitable\nsudo python3 setup.py install\n\n# Ensure AddressSanitizer is available (comes with Clang)\nwhich clang\n# If not installed, install Clang\nsudo apt install clang\n\n# Set up environment variables for AddressSanitizer\nexport ASAN_SYMBOLIZER_PATH=$(which llvm-symbolizer)\nexport ASAN_OPTIONS=symbolize=1:abort_on_error=1\n\n# Compile a target program with AddressSanitizer\ncd ~\u002Ftuts\u002F && git clone --branch master --depth 1 https:\u002F\u002Fgithub.com\u002Fhardik05\u002FDamn_Vulnerable_C_Program vuln\n# change int main(char *argv,int argc) to int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)\n# use size instead of argc and data instead of argv\ncd vuln && echo \"IMG\" > crash_input && clang -g -O1 -fsanitize=address,fuzzer -o target_asan dvcp.c\n\n# Example: Analyze a crash using GDB and 'exploitable'\ngdb -ex \"run \u003C crash_input\" \\\n    -ex \"exploitable\" \\\n    -ex \"quit\" --args .\u002Ftarget_asan\n# Script to automate crash analysis\nmkdir analyzed_crashes\nfor crash in crash-*; do\n    echo \"Analyzing $crash\"\n    gdb -batch -ex \"run \u003C $crash\" \\\n        -ex \"exploitable\" \\\n        --args .\u002Ftarget_asan &> analyzed_crashes\u002F$(basename $crash).log\ndone\n\ncurl --proto '=https' --tlsv1.2 -sSf \"https:\u002F\u002Fsh.rustup.rs\" | sh\ncargo install casr\ncasr-san -o asan.casrep -- .\u002Ftest_asan_df\n\n# Install afl-collect if using AFL++\nsudo apt install afl-utils\n\n# Collect and deduplicate crashes\nafl-collect -rr --crashdir crashes_deduped \\\n            --workdir afl_output -j 4 \\\n            -- .\u002Ftarget_asan @@\n# Compile with UBSan\nclang -g -O1 -fsanitize=undefined -o target_ubsan target.c\n```\n\n### Day 7: Review and Recap\n\n- **Goal**: Consolidate the knowledge gained during Week 1 by reviewing key concepts, clarifying doubts, and reinforcing practical skills in fuzzing and, initial crash analysis.\n- **Activities**:\n  - **Review Session**:\n    - Revisit the key concepts from Days 1 to 6:\n      - Fundamentals of fuzzing and its importance in security testing.\n      - Hands-on experience with fuzzing tools: `AFL++`, `FuzzTest`, `HonggFuzz`, and `Syzkaller`.\n      - Setting up fuzzing environments and running basic to advanced fuzzing campaigns.\n      - Initial crash analysis and triaging techniques.\n    - Discuss any challenges faced during the exercises and share solutions.\n  - **Reading**:\n    - _Summary Articles_:\n      - [A Brief History of Fuzzing](https:\u002F\u002Fwww.oreilly.com\u002Flibrary\u002Fview\u002Ffuzzing-for-software\u002F9780596554024\u002Fch01.html)\n      - [Best Practices in Fuzzing](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FFuzzing)\n    - _Documentation_:\n      - Revisit the documentation for the tools used to reinforce understanding of their features and options.\n  - **Knowledge Check**:\n    - **Quiz**:\n      - Prepare a set of questions to test your understanding of the week's material.\n        - What are the main differences between `AFL++` and `HonggFuzz`?\n        - How does in-process fuzzing with `FuzzTest` differ from traditional fuzzing methods?\n        - Explain the purpose of sanitizers like AddressSanitizer in fuzzing campaigns.\n        - Describe the process of setting up `Syzkaller` for kernel fuzzing.\n    - **Flashcards**:\n      - Create flashcards for important terms and concepts, such as:\n        - Mutation-based fuzzing\n        - Coverage-guided fuzzing\n        - Sanitizers\n        - Crash triaging\n        - Deduplication of crashes\n  - **Hands-On Practice**:\n    - **Consolidate Exercises**:\n      - Re-run previous fuzzing sessions with additional configurations to reinforce learning.\n      - Try fuzzing a new simple application using the tools you've learned.\n    - **Collaborative Learning**:\n      - If possible, discuss with peers or online communities about your findings and methodologies.\n      - Share your crash analysis reports and get feedback.\n  - **Deep Dive into Topics of Interest**:\n    - Choose a topic or tool from the week that you found most challenging or interesting and spend extra time exploring it.\n      - For example, delve deeper into `Syzkaller`'s syscall descriptions or explore advanced options in `AFL++`.\n- **Discussion Points**:\n  - **Challenges and Solutions**:\n    - Reflect on any obstacles you faced during the exercises.\n    - Discuss strategies for overcoming common issues in fuzzing campaigns, such as dealing with large numbers of crashes or configuring complex tools.\n  - **Real-World Applications**:\n    - Consider how the fuzzing techniques learned can be applied to real-world software projects.\n    - Discuss the impact of effective fuzzing on software security and quality assurance.\n- **Tips**:\n  - **Documentation and Note-Taking**:\n    - Maintain detailed notes of your configurations, commands used, and observations from your fuzzing sessions.\n    - Document any anomalies or unexpected behavior for future reference.\n  - **Tool Mastery**:\n    - Familiarize yourself with the command-line options and configurations of each tool.\n    - Practice writing custom scripts to automate repetitive tasks in your fuzzing workflow.\n- **Reflection**:\n  - **Self-Assessment**:\n    - Evaluate your understanding of the week's material.\n    - Identify areas where you feel confident and areas that may require additional study.\n  - **Goal Setting**:\n    - Set specific objectives for the next week based on your reflection.\n    - For example, aim to understand advanced features of a particular fuzzing tool or improve your crash analysis skills.\n- **Optional Activity**:\n  - **Beginner's Capture the Flag (CTF)**:\n    - Participate in a beginner-level CTF that focuses on binary exploitation and fuzzing challenges.\n    - Apply the skills you've learned in a competitive and practical environment.\n- **Additional Resources**:\n  - **Books**:\n    - _\"The Art of Software Security Assessment\"_ by Mark Dowd, John McDonald, and Justin Schuh – Chapters on fuzzing and vulnerability discovery.\n  - **Online Courses**:\n    - [Coursera: Software Security](https:\u002F\u002Fwww.coursera.org\u002Flearn\u002Fsoftware-security) – Sections related to input validation and fuzz testing.\n- **Action Items for Next Week**:\n  - Prepare for Week 2, which focuses on Crash Analysis.\n  - Ensure your environment is set up with debugging tools like GDB, WinDbg (for Windows), and other necessary utilities.\n\n## Week 2: Crash Analysis\n",{"name":5,"domain":34,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Foffensive-exploit-dev-course","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill offensive-exploit-dev-course",{"tool":59,"command":60},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill offensive-exploit-dev-course",{"tool":62,"command":63},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill offensive-exploit-dev-course","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-exploit-dev-course\u002FSKILL.md",true,[67],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"index.json","REFERENCE","参考文档",602,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-exploit-dev-course\u002Findex.json",[74,99,121,143,164,180],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":41},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,34,98],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":41},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[26,81,106,84,107,108,109,34,110,111,112,113,114,115,86,116,117,118,119,120],"services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":41},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[128,129,130,131,132,133,34,110,134,111,135,136,86,118,137,138,139,140,141,142],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":41},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[82,150,151,152,153,39,154,87,155,34,98,156,157,158,159,160,161,162,163,86],"processes token impersonate detect","token","processes","attacks","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":41},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[171,172,82,173,152,39,174,87,175,155,34,98,111,176,177,178,179,163,86,88],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":41},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[187,82,152,188,174,87,189,190,34,98,191,192,193,194,195,32,86,88,196,197],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","mismatched","headers"]