Michał Zalewski (lcamtuf)

I retired this site back in 2022 for a couple of reasons. If you like the content, please subscribe to the new blog at blog.coredump.cx .

This is an interesting demonstration of the capabilities of afl ; I was actually pretty surprised that it worked! $ mkdir in_dir $ echo ' h...

Many shell users, and certainly most of the people working in computer forensics or other fields of information security, have a habit of ru...

SQLite is probably the most popular embedded database in use today; it is also known for being exceptionally well-tested and robust. In co...

I made a very explicit, pragmatic design decision with afl-fuzz : for performance and reliability reasons, I did not want to get into stati...

Up until mid-2010, any rogue website could get a good sense of your browsing habits by specifying a distinctive :visited CSS pseudo-class ...

We spent a good chunk of the day investigating the now-famous bash bug (CVE-2014-6271), so I had no time to make too many jokes about it on...

The patch that implements a prefix-based way to mitigate vulnerabilities in bash function exports has been out since last week and has been...

For as long as I remember, HTTP cookies have been vilified as a grave threat to the privacy of online browsing. I don't quite agree, but I f...

OK, rebuild bash and deploy Florian's unofficial patch or its now-upstream version now. If you're a distro maintainer, please consider doi...

The nice thing about the control flow instrumentation used by American Fuzzy Lop is that it allows you to do much more than just, well, f...

Several years ago, the CSS :visited pseudo-selector caused a bit of a ruckus: a malicious web page could display a large set of links to as...

- 1 - Poland is an ancient country whose history is deeply intertwined with that of the western civilization. In its glory days, the Po...