Today I decided to start fuzzing IE to prepare for an upcoming pen test. I know the target has a small externally accessible attack surface, so developing a nice IE exploit seemed like a good idea. This is my first time fuzzing IE, and I'm immediately surprised by two things:
<br><ol><li>How easy it is to get IE to throw a fault</li><li>How ungodly slow IE loads fuzzed pages</li></ol>While the first is good, when I play the evil bad guy, the second is quite irksome. I think it might make a good talking point for MS, I mean Firefox loads the pages about 10x as fast so fuzzing is much easier. I can see it now, Microsoft: "Our web browser is so slow attackers can't exploit it". Maybe slowness is Microsoft's new anti-hacker strategy. Vista is their "most secure" OS and you can barely even surf the web while listening to music. I think I see a pattern!!! :)
<br><br>-- <br>Matthew Wollenweber<br><a href="mailto:mwollenweber@gmail.com">mwollenweber@gmail.com</a> | <a href="mailto:mjw@cyberwart.com">mjw@cyberwart.com</a><br><a href="http://www.cyberwart.com">www.cyberwart.com</a>