6

I've previously rolled my own Fuzzing Framework, and tried a few others like Peach Fuzzer. It's been awhile since I've looked at vulnerability hunting, what is the state of the art with regard to fuzzing? That is, if I were to start fuzzing Acme Corp's PDF Reader today, what toolset should I look into?

closed as off topic by asheeshr, Dougall, Keelan, APerson, nneonneo Mar 31 '13 at 11:02

Questions on Reverse Engineering Stack Exchange are expected to relate to reverse engineering within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

3

There are three types of fuzzers:

  • mutation fuzzers, which start with a large list of diverse, good input files and a list of mutations. Then, each file is mutated in some way and passed to the application to see if the app can handle the mutated input. Charlie Miller's 2010 CanSecWest talk covers this approach nicely. Generally it's straightforward to roll your own version of a mutation fuzzer for a file format.
  • generative fuzzers, which at their simplest just generate random output. More complex versions will be able to describe protocols and methods for injecting randomness in various fields of the protocols. Sulley is a tool in this class. A particularly nice subclass is grammar-based fuzzers, where you start with a BNF grammar and generate strings by walking the grammar directly.
  • whitebox fuzzers are arguably a different class, where some constraint solver reasons about code paths to generate new inputs for fuzzing. avalanche is a publicly available tool for this. (SAGE, the tool that @0xea pointed out, is another example.)

Another of Miller's papers has a nice overview of the first two. And you should probably see the Fuzzing book's website, which has some software you can start with.

  • this is hardly the state of the art, and that's the problem with this question , i don't think it can be answered in a good way – 0xea Mar 30 '13 at 14:45
  • @0xea, is it my breakdown into types of fuzzing or the tools that I list that isn't state of the art? – EfForEffort Mar 30 '13 at 14:54
  • the tools and papers, they are few years old, tho i know people are still using them with great success – 0xea Mar 30 '13 at 14:57
  • @0xea Innovation doesn't come over night. If those tools are a few years old but there has been no improvements, then they are still the state of the art. I don't see the problem. – mrduclaw Mar 30 '13 at 17:23
3

Don't know about the state of the art , but some advances have been in the direction of combining symbolic execution as with SAGE from MS Research (there should be a better paper, but I think it's paywalled). Also A Taint Based Approach for Smart Fuzzing shows how to combine taint analysis for advanced fuzzing (there should be some non-paywalled version around). Also, I expect most people don't really publish their advanced techniques until they exhaust them, which is the main problem of this question.

  • Right, there will always be the walled garden of secret techniques, but the state of the art is implied public knowledge. That is, it is the current state of the highest level of general development. There will always be outliers that perform better, but they are not the state of the art, they are the outliers above it. Nonetheless, thanks for the suggested reading. – mrduclaw Mar 30 '13 at 17:30
  • a fair point... – 0xea Mar 30 '13 at 19:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.