I've previously rolled my own Fuzzing Framework, and tried a few others like Peach Fuzzer. It's been awhile since I've looked at vulnerability hunting, what is the state of the art with regard to fuzzing? That is, if I were to start fuzzing Acme Corp's PDF Reader today, what toolset should I look into?
There are three types of fuzzers:
- mutation fuzzers, which start with a large list of diverse, good input files and a list of mutations. Then, each file is mutated in some way and passed to the application to see if the app can handle the mutated input. Charlie Miller's 2010 CanSecWest talk covers this approach nicely. Generally it's straightforward to roll your own version of a mutation fuzzer for a file format.
- generative fuzzers, which at their simplest just generate random output. More complex versions will be able to describe protocols and methods for injecting randomness in various fields of the protocols. Sulley is a tool in this class. A particularly nice subclass is grammar-based fuzzers, where you start with a BNF grammar and generate strings by walking the grammar directly.
- whitebox fuzzers are arguably a different class, where some constraint solver reasons about code paths to generate new inputs for fuzzing. avalanche is a publicly available tool for this. (SAGE, the tool that @0xea pointed out, is another example.)
Don't know about the state of the art , but some advances have been in the direction of combining symbolic execution as with SAGE from MS Research (there should be a better paper, but I think it's paywalled). Also A Taint Based Approach for Smart Fuzzing shows how to combine taint analysis for advanced fuzzing (there should be some non-paywalled version around). Also, I expect most people don't really publish their advanced techniques until they exhaust them, which is the main problem of this question.