Chapter 7

Question 1

Give examples of Memory Safe Vulnerabilities

Answer 1

• Buffer overflow
• Format String
• Integer Overflow

Question 2

Whitebox Bug Finding vs Blackbox Bug Finding

Answer 2

• Whitebox is internal structure testing with a deep understanding of the code and implementation
• Blackbox is functionality testing to ensure it behaves as expected

Question 3

What is Fuzzing?

Answer 3

• Automated software testing of feeding a software random, unexpected, or malformed inputs
• Detects crashes or software vulnerabilities

Question 4

What is Grey Box Fuzzing?

Answer 4

Fuzzing with runtime feedback (reactive)

Question 5

Black Box Fuzzing vs White Box Fuzzing

Answer 5

• Black box fuzzing uses random input generation
• White box fuzzing uses program structure and contraints for input

Question 6

What do Fuzzing Tools Do?

Answer 6

Automates:
- Input Generation
- Input Injection
- Bug Detection

Question 7

What is White Box Testing?

Answer 7

• Manual, systematic code inspection for weaknesses and vulnerabilities
• Conducted by developers and peers
• Can find defects earlier than test execution

Question 8

Give Examples of Common Memory Safety Issues

Answer 8

• Buffer Overflow: writing beyond array bounds
• Use-after-free: accessing freed memory
• Null pointer deference: using uninitialized or null memory
• Stack Overflow: Excessive Recursion