Coverage-guided binary fuzzer AFL instrumenting Nginx HTTP module source code to discover memory corruption
Nginx

Nginx exploit writing weekend

This weekend will be ripe of opportunities for nginx exploit writing. Trying a new scheduler algorithm and Stensal's compiler against nginx's stable code base.

Key takeaways
  • Fuzzing HTTP server modules uncovers deep parser edge cases that manual code audits miss.
  • Coverage-guided fuzzing is the most cost-effective method for discovering zero-day vulnerabilities.
  • Harden public reverse proxies with compiler sanitizers and aggressive resource limits.

This weekend will be ripe of opportunities for nginx exploit writing. Trying a new scheduler algorithm and Stensal’s compiler against nginx’s stable code base.

@meteor:~# afl-whatsup ~/Repository/FuzzMe/Nginx/sbin/findings/

status check tool for afl-fuzz by <[email protected]> with scheduler optimizations by <[email protected]> and <[email protected]>

Individual fuzzers

==================

fuzzer01 (4 days, 13 hrs) «<

cycle 1, lifetime speed 108 execs/sec, path 2626/3234 (81%)

pending 116/2979, coverage 13.58%, 92 crashes

fuzzer02 (4 days, 13 hrs) «<

cycle 429, lifetime speed 152 execs/sec, path 3562/4483 (79%)

pending 0/5, coverage 13.58%, 34 crashes

………

Summary stats

Fuzzers alive : 5

Total run time : 22 days, 17 hours

Total execs : 264 million

Cumulative speed : 669 execs/sec

Pending paths : 116 faves, 2999 total

Pending per fuzzer : 23 faves, 599 total (on average)

Crashes found : 471 locally unique