Overengineered Vulnerability Scanner

I wrote a vulnerability scanner that abstracts all the predicates in a binary, traverses the callgraph and generates phormulaes to run then with a SMT solver. I found 1 vuln in 3 days with this tool. He wrote a dumb ass fuzzer and found 5 vulns in 1 day. Good thing I'm not a n00b like that guy.

A Wojak developer boasts about building an elaborate vulnerability scanner using callgraph analysis and an SMT solver, but it finds only one vulnerability in three days. Another developer uses a simple fuzzer and finds five vulnerabilities in one day, exposing the first developer’s overengineering and arrogance. The meme is used to mock overly complex solutions that perform worse than simple practical tools.

• @infosecmemes / 32 2017-12-01