Bug bounty
Program discontinued
The Manalyze bug bounty program has been discontinued. The rise of low-quality, LLM-generated vulnerability reports has made triage increasingly time-consuming. Rather than spend the remaining bounty budget reviewing these reports, I have decided to use it for LLM tokens and look for bugs myself.Introduction
Manalyze's bug bounty invited researchers to identify flaws in the program and on this website, provided they did so ethically and reported their findings to the maintainers of this project.Former program rules
- The bounty for bugs was set to 100€, payable by wire transfer. Researchers could also opt for a donation to the charity of their choosing.
- Crashes in Manalyze were eligible as long as they occurred in code written by Manalyze's team. Bugs which could be traced back to third party code (i.e. YARA, OpenSSL...) were welcome and forwarded to their rightful recipients, but did not receive any compensation unless said library had been blatantly misused by Manalyze's maintainers.
- All bug reports had to be accompanied by relevant PE files causing the crash.
- Attack scenarios involving malicious plugins were out of scope: if the prerequisite for the attack was that someone could drop a DLL file on the victim's system, they probably did not need to exploit Manalyze to get remote code execution. For this reason, these types of attacks were not taken into account in the application's threat model.
- Researchers did not have to prove that a bug was exploitable. As long as Manalyze crashed, the bug was eligible (provided the conditions mentioned above were met).
- Security issues in the
manalyzer.orgmachine were eligible as well. However, only bugs which had an actual security impact were rewarded with money (i.e. exploitability had to be demonstrated). In particular, vulnerabilities commonly used to extort money from gullible clients or otherwise fill empty pentest reports (missing clickjacking headers, XSS on logout forms, etc.) were ignored. You know what these are. - Researchers were asked to do their best not to DoS this website.
- Manalyze's maintainers ultimately decided which bugs were awarded with money, and their decision could not be appealed.
- A maximum of two bounties were awarded per person. Researchers were asked to keep in mind that the money came out of the maintainers' personal bank accounts.
Hall of Fame
- Kim Gwan Yeong (twice: fix 1, fix 2)
- Mehdi Kerimov (100€: malformed PE parsing fixes)
Fuzzing Manalyze
This section contains instructions you can follow if you intend to fuzz Manalyze. In this example, lcamtuf's AFL is used and the fuzzing effort is focused on the PE parser. The following lines indicate how to get the latest version of Manalyze and build a minimal executable to fuzz:mkdir -p manafuzz/include
git clone https://github.com/JusticeRage/Manalyze.git
cp -r Manalyze/manape Manalyze/manacommons manafuzz/
cp -r Manalyze/include/manape Manalyze/include/manacommons manafuzz/include/
cd manafuzz
cat > main.cpp <<'EOF'
#include "manape/pe.h"
int main(int argc, char** argv)
{
if (argc < 2) {
return 2;
}
mana::PE pe(argv[1]);
return pe.is_valid() ? 0 : 1;
}
EOF
afl-g++ \
-std=c++17 \
-DWITH_MANACOMMONS \
-Iinclude \
main.cpp \
manape/*.cpp \
manacommons/color.cpp \
manacommons/escape.cpp \
-o manafuzzafl-clang-fast++ for afl-g++.
Of course, you can edit the contents of main.cpp to call any additional function you want to fuzz: all this example does is load a PE file and parse it, before exiting.The next step is to gather some PE executables which will be used as input files. Options include the handcrafted PEs from the Corkami project, as well as the files used by Foxglove to fuzz ClamAV. Assuming you put these input files in a folder called
input/ and want to save the results in a folder called output/, use the following command to launch AFL:
afl-fuzz -m500 -i input/ -o output/ -t100 -- manafuzz @@