While discussing the threat model of the cURL application, one of TrailOfBits team members jokingly asked, “Have we tried curl AAAAAAAAAA… yet”? Although the comment was made in jest, it sparked an idea: we should fuzz cURL’s command-line interface (CLI). This blog post describes how the security researchers found 5 critical vulnerabilities, through this one joke: Learn more.

From: Maciej Domanski