HACKING PROJECT · cloud · Advanced
0-Day Exploit Finder & Builder (Fuzzing)
Construct a coverage-guided fuzzing and crash-triage pipeline that carries a vulnerability from discovery to a lab proof-of-concept exploit.
Memory-safety and logic vulnerabilities remain the root cause of the most severe CVEs, yet most security students never run a coverage-guided fuzzer, triage a crash, or walk the road from crash to controllable primitive. Vendors and bug-bounty teams need researchers who can find, root-cause, and responsibly weaponize (as PoC) novel bugs. This capability gap sits squarely in vulnerability research.
**What you'll build**
Build an end-to-end vulnerability-research pipeline: harness a target binary/library, run coverage-guided fuzzing (AFL++/libFuzzer/honggfuzz), automatically triage and de-duplicate crashes, root-cause with a debugger and sanitizers, and develop a proof-of-concept exploit against a deliberately vulnerable target in a lab. Wrap it with crash-corpus management, exploitability scoring, and a coordinated-disclosure workflow. The deliverable is a repeatable finder-to-PoC toolkit, not live-target attacks.
**Objective** — Construct a coverage-guided fuzzing and crash-triage pipeline that carries a vulnerability from discovery to a lab proof-of-concept exploit.
**Expected outcome** — A working fuzzing harness + triage tooling plus a documented root-cause analysis and PoC for at least one seeded/known-vulnerable target, with a disclosure report.
**Difficulty** — Expert — demands fuzzing, sanitizers, exploit primitives (ROP, heap grooming), and mitigation bypass reasoning.
**Primary category** — Vulnerability Research & Exploit Development; Secondary = Reverse Engineering, Application Security, Secure SDLC
**Security domains** — Primary = Security Research; Secondary = Red Team, Malware Analysis, DevSecOps
**Technical focus** — coverage-guided fuzzing, grammar/structure-aware fuzzing, crash triage & deduplication, exploitability analysis, memory-safety bugs (UAF, heap/stack overflow), ROP/JOP chain building, ASLR/DEP/CFG mitigation bypass, sanitizer instrumentation (ASan/UBSan), corpus minimization, coordinated disclosure
**Core technologies** — Languages: C, C++, Python, x86-64 assembly; Frameworks/Libraries: AFL++, libFuzzer, honggfuzz, LibAFL, angr, pwntools; Security Tools: GDB+GEF/pwndbg, Ghidra, IDA, ASan/UBSan, QEMU; Cloud/Infra: containerized fuzzing farm, CI fuzz jobs, cloud burst nodes; AI/Data: ML-assisted seed/input generation, crash clustering; Databases: crash-corpus store, SQLite/Postgres
**Where it's valued** — Bug bounty, vendor PSIRTs, browser/OS/kernel security teams, defense/offensive research, automotive & IoT security
**Careers it builds toward** — Vulnerability Researcher, Exploit Developer, Security Researcher, Fuzzing/Bug-Hunting Engineer, Product Security (PSIRT) Engineer
**Framework alignment**
• MITRE ATT&CK: Resource Development — Develop Capabilities: Exploits (T1587.004), Obtain Capabilities: Exploits (T1588.005); Initial Access/Execution — Exploitation for Client Execution (T1203); Privilege Escalation — Exploitation for Privilege Escalation (T1068)
• NIST CSF 2.0: Identify (vulnerability discovery) and Protect (feeding fixes/mitigations); supports Detect via crash signatures
• OWASP: A06:2021 Vulnerable & Outdated Components; broadly supports SAMM/secure-SDLC verification
• CIS Controls v8: 16 (Application Software Security), 18 (Penetration Testing), 7 (Continuous Vulnerability Management)
**Innovation** — Research-Level Project — automated finder-to-PoC pipelines with ML-assisted seeding sit at the research frontier and can yield genuinely novel findings. Scores: Innovation 9/10, Startup 6/10, Enterprise-Readiness 6/10, Patent = Possible.