Company
Date Published
Author
Antonio Morales
Word count
2167
Language
English
Hacker News points
None

Summary

In this blog post, the author elaborates on advanced techniques for fuzz testing Apache HTTP, focusing on creating custom Address Sanitizer (ASAN) interceptors to address memory management issues that arise from custom memory pool implementations. The article discusses the limitations of ASAN's default behavior and presents a method for implementing manual memory poisoning and custom interceptors to better handle memory allocations and detect bugs that might otherwise go unnoticed. The author provides a detailed walkthrough on setting up these interceptors by modifying LLVM sanitizers and intercepting specific functions like malloc and free. Additionally, the post introduces a basic file monitoring approach to detect logic vulnerabilities in file system syscalls, which are not typically captured by standard fuzzers like AFL. The article concludes with a promise to reveal findings on Apache HTTP vulnerabilities and share insights from the author's research in a forthcoming installment.