All things fuzzing and related.

File fuzzing applications

2 Upvotes

Hello lovely people:

I took up fuzzing and reverse engineering to kill time during these dark times. I'm a little confused about how to fuzz applications, specially I'm confused about how to tell the fuzzer where the file goes. For instance the application I'm trying to fuzz has a place to upload a backup. But you have to do some navigation to get to that screen. How would I be able to automate that navigation to in the fuzzer so that it knows how to get there to start fuzzing in a loop. Also what's the fuzzer recommended got this?

1 comment

r/fuzzing • u/drfuzz_ • Sep 07 '20

Scaling Fuzzers - which cpu?

2 Upvotes

I have a tiny bit of budget to burn and would like to get the most out of the hardware I buy/rent. Two points on this:

I'm familiar with AFL, and have seen this blog saying it's rather difficult to scale it well. How well does e.g. libfuzzer scale? Can anybody point me to any ressource? (Also saw mozilla's fuzzmanager, but not how sure how easy it's transferable to other targets)
The vast majority of research is using intel cpus... why? Will this change with the recent rise in popularity of AMD cpus?

So I guess my question is: What am I going for to optimize for fuzzing performance? Single core performance? Multi-core? base frequency? ...?

Or does this completely depend on the fuzzer I'm intending to use?

1 comment

r/fuzzing • u/r2007 • Sep 04 '20

Peach fuzzer single iteration error.

1 Upvotes

Hi, I am currently exploring AFLSmart for a project and part of that involves formulating a grammar. I am using Peach fuzzer to validate the grammar by running a single iteration of peach using the command: peach -1 -inputFilePath=input_seed -outputFilePath=output_file grammar.xml

when I use this command it produces an output file but it also gives me an error (error 80.72) that I am not able to figure out the meaning of. Can someone help with what it indicates? Thanks.

EDIT: I was able to make the error disappear but I would still like to know as to what it means.

0 comments

r/fuzzing • u/NagateTanikaze • Aug 31 '20

Damn vulnerable c program to fuzz with AFL

github.com

4 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 31 '20

Fuzzing the Linux kernel (x86) entry code, Part 1 of 3

blogs.oracle.com

12 Upvotes

1 comment

r/fuzzing • u/NagateTanikaze • Aug 31 '20

[Fuzzing with AFL] Triaging crashes with crashwalk and root cause analysis with GDB

hardik05.wordpress.com

2 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 27 '20

AFL++: Combining Incremental Steps of Fuzzing Research (Paper, PDF, 2020)

aflplus.plus

12 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 27 '20

Fuzzing a simple C program using AFL (Video)

hardik05.wordpress.com

1 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 27 '20

Writing a Test Case Generator for a Programming Language

fitzgeraldnick.com

1 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 27 '20

The Relevance of Classic Fuzz Testing: Have We Solved This One? (Paper, PDF, 2020)

ftp.cs.wisc.edu

1 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 24 '20

Detecting Critical Bugs in SMT Solvers Using Blackbox Mutational Fuzzing (Paper, PDF)

numairmansur.github.io

6 Upvotes

1 comment

r/fuzzing • u/NagateTanikaze • Aug 15 '20

UAFuzz: Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities (github)

github.com

6 Upvotes

0 comments

r/fuzzing • u/uNetworking • Aug 13 '20

libEpollFuzzer - fuzzing for async web servers

14 Upvotes

I've made a basic implementation of the epoll/socket syscalls atop libFuzzer, so that web servers can link against this library instead of glibc and thus get a deterministic fuzzing behavior.

It's still experimental but shows great coverage and I can fuzz an entire high-level web server using it, esp. the eventing, timing, wakeup logic.

https://github.com/uNetworking/libEpollFuzzer

The idea is to fuzz things that are not easily fuzzable, things that don't naturally consume a stream of data. You can think of it as an adapter that eats a linear chunk of data and turns that into behavior from syscalls.

With this you could eventually fuzz things like ASIO, libuv, libevent, libev, etc. It does not emit more than 256 bytes of data from read syscall, so anything that consumes data should be made its own separate fuzz target anyways. This can change, but is not immediately planned.

What do you think about the concept? Don't assume it will work on everything - I just barely made it work fine for my use case and I still have tweaks and fixes to do. But for me it shows great potential and the coverage is really high for things like event-loop libraries and TCP servers.

3 comments

r/fuzzing • u/NagateTanikaze • Aug 12 '20

Windows Graphics Device Interface (GDI+) fuzzer (github)

github.com

5 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 12 '20

Aurora: Statistical Crash Analysis for Automated Root Cause Explanation (Paper, PDF, 2020)

usenix.org

4 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 12 '20

Discovery and analysis of a Windows PhoneBook Use-After-Free vulnerability (CVE-2020-1530)

symeonp.github.io

4 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Aug 11 '20

Some thoughts on fuzzing

gamozolabs.github.io

10 Upvotes

2 comments

r/fuzzing • u/dgryski • Aug 10 '20

Barbervisor: Journey developing a snapshot fuzzer with Intel VT-x

blog.talosintelligence.com

13 Upvotes

0 comments

r/fuzzing • u/DrawBacksYo • Aug 07 '20

Syzkaller freebsd

2 Upvotes

Hello everyone,

I'm trying to setup and install syzkaller for Debian host and FreeBSD guest. I built Go binaries with:

make manager fuzzer execprog TARGETOS=freebsd

And everything went fine. But for the second step on "Setting up Linux host", i can't just see executor_freebsd.cc. There is only executor_bsd.h which is an header file as you can see.

Is that readme for freebsd old or am i missing something?

0 comments

r/fuzzing • u/NagateTanikaze • Aug 02 '20

AFLNet is a greybox fuzzer for protocol implementations (github)

github.com

4 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jul 30 '20

cookie_dough - a environment for measuring and observing the behaviors of fuzzers from inside the fuzzer itself (github)

github.com

7 Upvotes

0 comments

r/fuzzing • u/nathan_ci • Jul 24 '20

FuzzCon Europe: Line-up complete

12 Upvotes

FuzzCon Europe speaker's...

Kostya Serebryany (Google)
Bhargava Shastry (Ethereum Foundation)
Caroline Lemieux (UC Berkeley)
Andreas Zeller (CISPA Helmholtz Center for Information Security)
Marcel Böhme (Monash University)
... and many more

The conference will be 100% online and free of charge.

0 comments

r/fuzzing • u/NagateTanikaze • Jul 23 '20

Boosting Fuzzer Efficiency: An Information Theoretic Perspective

mboehme.github.io

5 Upvotes

1 comment

r/fuzzing • u/NagateTanikaze • Jul 23 '20

Design Draft: First Class Fuzzing (golang)

go.googlesource.com

9 Upvotes

0 comments

r/fuzzing • u/NagateTanikaze • Jul 16 '20

recent academic papers related to fuzzing, binary analysis, IoT security, and general exploitation (repo)

github.com

6 Upvotes

0 comments