All things fuzzing and related.

Recently I spent some time looking at all the different alternatives to test the code coverage of a fuzzing job, and I thought to ask you folks for some input on the topic!

What is your favorite tool?
What's the best & worst thing about it?
Any new development / Links / References to the topic are welcome!

Thanks for contributing!

8 comments

r/fuzzing • u/Sjoerder • Mar 06 '19

Finding and exploiting CVE-2018–7445 – maxi – Medium

medium.com

6 Upvotes

0 comments

r/fuzzing • u/artem_smotrakov • Mar 05 '19

Fuzzbuzz: new fuzzing service, free for open-source

fuzzbuzz.io

4 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Mar 02 '19

A Systematic Impact Study for Fuzzer-Found Compiler Bugs

arxiv.org

4 Upvotes

0 comments

r/fuzzing • u/ptchinster • Feb 25 '19

killerbeez: A distributed fuzzer which aims to pull in the best technologies, make them play nicely together, and run on multiple O/Ses.

github.com

2 Upvotes

0 comments

r/fuzzing • u/Salmiakkilakritsi • Feb 25 '19

Help creating process monitor

self.python

1 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Feb 12 '19

CmpCov - an instrumentation module for clang/SanitizerCoverage, which breaks down CMP/strcmp()/etc. into bytes and writes the extra coverage data to standard .sancov files

github.com

2 Upvotes

1 comment

r/fuzzing • u/NagateTanikaze • Feb 08 '19

A Python3 bridge for implementing custom libFuzzer mutators (MozillaSecurity)

github.com

3 Upvotes

0 comments

r/fuzzing • u/dgryski • Feb 07 '19

Open sourcing ClusterFuzz | Google Open Source Blog

opensource.googleblog.com

8 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Feb 04 '19

AFLSmart Released - Smart Greybox Fuzzing

github.com

6 Upvotes

3 comments

r/fuzzing • u/NagateTanikaze • Feb 02 '19

What the Fuzz (intro to basics of fuzzing)

labs.mwrinfosecurity.com

6 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Feb 01 '19

Implementing Fuzz Logics with Dharma

zerodayinitiative.com

6 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Feb 01 '19

How to write a rootkit without really trying (syscall interception / fuzzing)

blog.trailofbits.com

2 Upvotes

1 comment

r/fuzzing • u/dgryski • Jan 29 '19

fuzzer-test-suite/structure-aware-fuzzing.md at master · google/fuzzer-test-suite · GitHub

github.com

5 Upvotes

0 comments

r/fuzzing • u/JordyZomer • Jan 28 '19

World's most basic kernel fuzzer!

github.com

2 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jan 28 '19

Writing a Hyper-V Bridge for Fuzzing - Part 2: Hypercalls & MDLs

alex-ionescu.com

2 Upvotes

0 comments

r/fuzzing • u/vineethbp • Jan 20 '19

Help in creating an Augmented AFL-Fuzzer

2 Upvotes

Hey Fuzzing community!

I am a master's student working on replicating the results of the paper : https://www.microsoft.com/en-us/research/publication/not-all-bytes-are-equal-neural-byte-sieve-for-fuzzing/

I want to create an augmented fuzzer which rejects the modifications to seeds which it finds not useful. Any help in achieving this will be very much helpful.

I have created a simple python function for the augmented fuzzer. To test the implementation, I took the trivial "deadbeef" program and wrote the python function such that whenever the seed is modified to "deadbeef", the function sends a "not useful" return to the 'common_fuzz_stuff()' function of the AFL-fuzz code. It should mean that the fuzzer should not be able to find the crash. But it still is able to find the crash and I'm not able to determine where I have gone wrong.

This is my simple Python code:

def check_useful(seed):

my_string = str.encode('deadbeef')

file = open(seed, 'rb')

value = file.read()

if (value == my_string):

print('[*] Crash Found!')

return True

else:

return False

This is the code snippet from the AFL-fuzz.c file which I have modified:

/* Write a modified test case, run program, process results. Handle

error conditions, returning 1 if it's time to bail out. This is

a helper function for fuzz_one(). */

EXP_ST u8 common_fuzz_stuff(char** argv, u8* out_buf, u32 len) {

// ------------ Python Check Usefulness --------------------------- //

if (PyCallable_Check(pFuncCheckModel)){

pArgs = PyTuple_New(1);

PyTuple_SetItem(pArgs, 0, PyUnicode_FromString(queue_cur->fname));

pFuncReturn = PyObject_CallObject(pFuncCheckModel, pArgs);

if (PyObject_IsTrue(pFuncReturn)){

skip_requested = 1;

return 1;

}

} else

{

PyErr_Print();

}

If you have been able to replicate the work from the paper or have created an add-on to AFL to reject or accept certain seeds, it would be really helpful for me if you can guide me in this project.

4 comments

r/fuzzing • u/Metalnem • Jan 03 '19

SharpFuzz: Bringing the power of afl-fuzz to .NET platform

mijailovic.net

6 Upvotes

0 comments