Automatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
summary
Automated fuzzing framework builds and runs realistic exploits (MSRPC, PHP/HTTP, Heartbleed/OpenSSL, SMB) with randomized protocol evasions to find gaps in NGFW/IPS normalization. The team releases Evader and the orchestrator Mong to run massive parallel tests, records full pcaps and replayable command lines, and finds that a single pulse elimination TCP evasion lets payloads pass multiple vendors; only one vendor resisted a ten‑minute fuzzing run. Most devices fail; fixes require low‑level protocol alignment.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:53Understanding evasions
- 3:53The mechanics of evasion
- 6:21Testing methodologies
- 11:00The Mongbat tool
- 12:35Research results
- 16:44Common evasion techniques
- 19:31Overcoming testing challenges
- 23:00Key research findings
- 25:04Tool availability and demos
- 28:01Demonstration review
- 33:17Q&A session
related talks
01h 08mAutomated Dynamic Fireware Analysis At Scale: A Case Study on Embedded Web Interfaces
28mFuzzing Malware for Fun & Profit
28mBlue Team Fundamentals
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
42mCPU Fuzzing: Automatic Discovery of...
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
57mEnterprise Ethical Hacking Cloud Applications
37mFinding Vulnerabilities in IoT Embedded Devices Using Linux OS and Open Source Tools