Fuzzing Java code (JSoup) using Jazzer fuzzer - Java Security

How to create a fuzzing harness using Jazzer to find uncaught exceptions in the JSoup Java library.

📥 Download source code and materials: academy.fuzzinglabs.com/fuzzing-java-code-jazzer?coupon=yout… In this course, I will fuzz a popular Java library (JSoup) in order to find uncaught Java exceptions. I will explain how to create a fuzzing harness for this target using the Jazzer fuzzer. Then, I will run it and show you what's happening when you trigger crashes. #Fuzzing #Java #Exception 0:00 Presentation 1:04 Jazzer 2:32 Today's target (JSoup) 3:09 Installation/compilation of Jazzer 3:58 Find a good JSoup API 5:38 Write a Jazzer fuzz target 10:04 Modify the config files 12:45 Run the fuzzer 13:54 First crash (IllegalArgumentException) 15:45 Modify the code to throw this bug 17:36 Storing corpora between each run 19:53 Second crash (NullPointerException) Further readings: - github.com/CodeIntelligenceTesting/jazzer - blog.code-intelligence.com/fuzzing-for-jvm-is-now-open-sourc… - security.googleblog.com/2021/03/fuzzing-java-in-oss-fuzz.htm… ==== 💻 FuzzingLabs Training ==== - Rust Security Audit and Fuzzing: academy.fuzzinglabs.com/rust-security-audit-and-fuzzing-trai… - C/C++ Whitebox Fuzzing: academy.fuzzinglabs.com/c-whitebox-fuzzing?coupon=youtube - WebAssembly Reversing and Dynamic Analysis: academy.fuzzinglabs.com/wasm-security-reversing-dynamic-anal… - Go Security Audit and Fuzzing: academy.fuzzinglabs.com/go-security-audit-and-fuzzing?coupon… ==== 🦄 Join the community ==== academy.fuzzinglabs.com/fuzzing-labs-community 📡 Socials: - Twitter: twitter.com/FuzzingLabs - Telegram: t.me/fuzzinglabs - TikTok: tiktok.com/@fuzzinglabs Keyword: Fuzzing, Fuzz Testing, Java, Jazzer, Maven, Bazel Link to this video: youtu.be/Ai3wnnSFC-8