#NahamCon2022EU: Till REcollapse: Fuzzing the Web for Mysterious Bugs by @0xacb

### Overview In this talk presented at NahamCon 2022 EU, André (known online as @0xacb or master of mystery), co-founder of Ethiack and ethical hacking professor at the University of Porto, introduces techniques and tools for black-box fuzzing of regular expressions. Modern web applications heavily rely on regular expressions for input validation, sanitization, and normalization, but implementations across languages frequently suffer from subtle edge cases and inconsistencies. André demonstrates how systematic byte-level fuzzing around key regex positions can bypass strict security controls and lead to severe security vulnerabilities like account takeover and web cache deception.

### Key Topics - **Regex Implementations and Edge Cases**: Developers often copy-paste regexes from external sources without comprehensive testing, or use automated generation (e.g., GitHub Copilot) that introduces bypasses like unescaped dots (`.`) matching arbitrary characters. Furthermore, common constructs such as the end-of-string anchor (`$`) behave inconsistently across languages (e.g., JavaScript rejects trailing newlines, Python allows a single newline before the end, and Ruby matches regardless of subsequent lines unless configured differently). - **Validation vs. Extraction Flaws**: Applications often validate full user inputs against a regex pattern but subsequently process the unextracted raw input rather than matched groups, allowing attackers to inject trailing or unvalidated bytes. - **The REcollapse Methodology**: Black-box fuzzing of unknown backend regexes by systematically injecting byte values (`0x00` through `0xFF`) into three pivot locations: 1. *Starting and termination positions* (probing anchor assertions). 2. *Separator positions* (probing delimiters, special characters, and group boundaries). 3. *Normalization positions* (fuzzing characters, especially vowels, that get transformed or canonicalized by backends). - **The `recollapse` Tool**: A helper tool developed by the speaker that generates mutated input lists based on these pivot rules and supports different encodings (raw, URL-encoded, JSON bodies) and multi-byte fuzzing. It is designed to pipe wordlists into scanners like Burp Intruder or ffuf.

### Technical Details - **Open Redirect to Account Takeover Demo**: Illustrates taking a validated domain (`example.com`) redirect parameter and fuzzing separator positions with single bytes. The author identifies that an `@` character followed by domain manipulation (`example.com@evil/.com`) bypassed filtering, which could be chained with an integer/decimal IP host to leak sensitive authentication tokens to an attacker-controlled server. - **Web Cache Deception Case Study**: On a red-acted target API endpoint (`/wp-json/v1/user`), typical cached extensions (`.css`, `.pdf`, `.js`) yielded `404` errors. By fuzzing bytes prior to the extension, the author discovered that `%23` (`#`) or `%3F` (`?`) before `.pdf` (e.g., `%23.pdf`) caused the backend API to return a `200` response containing a user API token while the caching layer treated it as a cacheable static asset (`X-Cache: HIT`), enabling token theft. - **Shopify / OAuth Zero-Interaction Account Takeover**: Demonstrates exploiting normalization quirks across OAuth identity flows (specifically involving `accounts.shopify.com` and a third-party app, `teller.app`). While the email change endpoint rejected unusual characters, the sign-up endpoint accepted a mutated character (such as a special unicode `i` or `a` character). When the identity provider forwarded the account via OAuth, the downstream application normalized the email into the victim's canonical address, granting unauthorized access without user interaction.

### Takeaways - **Developers**: Ensure regular expressions are strictly tested and fuzzed across target runtime libraries. When validating inputs, explicitly extract matched substrings rather than processing raw strings. - **Security Researchers**: Black-box fuzzing of locked-down input fields frequently exposes language-specific regex quirks, differential parsing across endpoints, or normalization discrepancies. Minor input modifications and single-byte variations can escalate into critical vulnerabilities.