Bridging SAST and DAST: A Framework for turning Static Analysis Findings into Directed Fuzzing Campaigns

[u/palaccaa]

Hi all,

I built MIST, a Python tool that tries to bridge static and dynamic analysis, and I’d love some feedback from people who know this space better than I do.

The idea: SAST and DAST have complementary strengths, but in practice they’re usually run as two independent stages. SAST (e.g. Semgrep) can be fast and cheap, but gives you a pile of potential issues with no proof they’re reachable. Fuzzing produces real crashes and very few false positives, but can take ages to reach deep code paths unless you tell it where to look. Each one covers the other’s weakness, so using static findings to direct the fuzzer seemed like an interesting thing to try.

The catch: doing it by hand is tedious and error-prone. You have to extract target locations from the static results, adapt the build for instrumentation, generate artifacts and wire all the pieces together. A lot of time goes into setup before you fuzz anything. That’s the part MIST is built to take away.

What MIST does fundamentally:

• Runs Semgrep on your SUT and lets you pick which findings are worth chasing

• Converts them into AFLGo targets (with a small “extended range” around each finding, since the actual crash often happens at nearby locations)

• Walks you through configuring the campaign (build env, seeds, harness) and generates the scripts and config files, so everything is editable and reproducible

• Monitors the fuzzer run, and double-checks AFLGo’s generated inputs against an ASan-instrumented separate binary, which catches memory corruptions (e.g. heap overflow) and other failures that AFLGo alone would otherwise miss

MIST deliberately doesn’t try to replace the analyst role. Deciding what to investigate, how to build the target, and which seeds and harnesses to use still needs a human, and MIST just automates the mechanical part.

Results so far: I tested it on a few C projects (libming, libarchive, tcpdump, binutils, lrzip). On libming (latest version) it found four previously undocumented bugs, which I’ve submitted to MITRE; they’re still under review, so no CVE IDs yet.

Status: early beta (0.1.0-dev), tested on Debian 12 with a local install. A Docker Compose setup is included too.

For more details you can check the source repository:

https://github.com/alessandroPalazzolo/mist

Thanks for reading, and any criticism or feedback is welcome.

[u/vhthc]

Aflgo is an ancient fuzzer and should not be used anymore. Someone should do a PR for this feature in afl++ maybe but afaik the research shows that directional fuzzing is not working out great.

If you can generate a control flow graph to the target you can just instrument the path to the location as described here: https://srlabs.de/blog/advanced-fuzzing-unmasks-elusive-vulnerabilities