I am working on a project to find vulnerabilities on desktop software. I would like to have a idea for tools I could use to scan the Firefox browser to find vulnerabilities in it, like buffer overflows, DoS, arbitrary code execution, etc. Either paid, or a free tool will be better that can do the job.
closed as off-topic by Steffen Ullrich, Deer Hunter, Philipp, schroeder♦ Jan 11 '16 at 2:26
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Steffen Ullrich, Deer Hunter, Philipp, schroeder
It's not that simple. You need to learn about fuzzing and debugging.
There's no magic scanner that can find vulnerabilities.
A good tool for fuzzing is Peach Fuzzer, but if you don't know about debugging, assembly, cpu registers, etc... you won't get very far.
A good book to get you started is "Hacking The Art of Exploitation"
You won't find something that gives you an export of vulnerabilities to a program, although you can use tools that will analyze and probe the application; in this case FireFox being that target.
Maybe an alternative to your research is looking at previously patched vulnerabilities to FireFox on public databases. Also known as Common Vulnerabilities and Exposures or "CVE" as commonly stated.
Check out CVE-2015-0802. https://www.exploit-db.com/exploits/37958/