“As my friends and colleagues know, I have always been a huge fan of Alisa Esage. She has always been an inspiration to me, and I am overjoyed to have had the opportunity to participate in her Zero Day Engineering course (), especially since it is currently
New video review:
"I would recommend this course to anyone who is interested in vulnerability research, specifically to those who are stuck at the stage of not knowing where to start" - Victor Cho
Further info & buy - ZDVR course:
New masterclass: Hacking KVM
Set up a Kernel Virtual Machine hacking platform, from zero to ready in four hours. Hands-on deep technical masterclass with essential theory.
Livestream: Saturday 10th August, 12:00-16:00 UTC
Instructor:
@alisaesage
Remote kernel debugging the KVM hypervisor (full walkthrough video):
KVM is distinguished from Qemu: the latter runs in user mode to handle device virtualization, while the former runs in privileged kernel to implement just the core hypervisor
My highlights for the exploit:
• Single bit clear is probably the weakest bug imaginable. It's not even a flip. Most people won't bother to look at it, most bug bounty programs will reject it as "likely unexploitable". It's one hell of a flex.
• Single bug leveraged for both
An (almost) full VM escape with a single bit clear. Wow
(Almost because ASLR & CFG bypass here is incompete so it can only pop calc without arbitrary code execution)
This piece of code in VirtualBox is well known and has been audited down and through, meaning that it took Cody
"I played around with JavaScript Engines in the past, developing exploits for known bugs. But with the new skills I learned from the Zero Day Vulnerability Research course, I watched the JavaScript Engines for Hackers masterclass with a fresh perspective. And it definitely helps
Patch for Google Chrome v8 Duplicate Property Type Confusion vulnerability CVE-2024-3832 + CVE-2024-3833 (only relevant snippets)
Closely match webassembly object that is being checked vs modified to disallow discrepancy on the field map level. + Some refactoring of webassembly
1st, WOW! it's 4 hours of pure gold.
Initially, she goes through the important core theories of fuzzing, and then she connects the dots by walking you through AFL's source code, which helps you deepen your understanding of how things work under the hood.
@zerodaytraining
is on its own an amazing resource as well, covering other aspects of binary analysis. The "0-day insights" are pure gold, research at the highest level.
I had the chance to attend the "Masterclass: Hacking open source fuzzers for smarter bughunting" by
@alisaesage
An amazing class, giving different perspective and insights on fuzzing!
Great learning from
@alisaesage
and
@zerodaytraining
. "Masterclass: Hacking open source fuzzers for smarter bughunting" covers different fuzzers as well as explaing code coverage in a hands-on mannner. Thank you very much for your exceptionally high quality course, I learned a
All the positive feedback of past few days <3 Now I am thinking to relaunch Saturday live hacking masterclasses
@zerodaytraining
, just for fun and to connect with you guys! Stay tuned!
I just finished the "Masterclass: Hacking open source fuzzers for smarter bughunting" from
@zerodaytraining
@alisaesage
As a Hacker and Vuln Re, I've been craving for practical insights in fuzzing, Alisa delivers just that.
In summary, Alisa's masterclass is like a turbo boost for the bug-hunting journey. Highly recommend training.
Alisa's work can be explored further on
My fav part that I wish I could take at some point :
+
I just finished the masterclass Hacking Open Source Fuzzers for Smarter Bug Hunting from
@zerodaytraining
and learned a lot.
It was my first real contact with fuzzing and despite it was not a "Fuzzing 101" type training, I understood all the teachings, kudos to
@alisaesage
,