Questions tagged [fuzzing]

A software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer system, then monitoring for exceptions, failed assertions, or memory leaks.

Filter by
Sorted by
Tagged with
1 vote
0 answers
58 views

Fuzzing closed application

I want to get from you some advice about fuzzing. I am checking a huge C application (not open source) which is also an HTTP server. My purpose is to fuzz the HTTP server via the requests being sent ...
flapz18716's user avatar
14 votes
2 answers
10k views

What are some ways to pass raw bytes to a program via the Linux terminal?

I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes ...
the_endian's user avatar
  • 1,860
1 vote
1 answer
335 views

Approach for fuzzing interactive CLI

I have an IoT system that has a command-line-based interactive shell that can be used to configure the system. While examining the disassembly/decompilation, I realized that there is a lot of ...
multithr3at3d's user avatar
2 votes
2 answers
187 views

Modern methods of fuzzing/locating heap bugs and potential vulnerabilites

really glad I found this great learning resource. I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
caterpillar's user avatar
2 votes
0 answers
200 views

submitting input into AFL fuzzer

I have some questions about the AFL Fuzzer: How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
Logan's user avatar
  • 71
-1 votes
1 answer
345 views

Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs

I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet ...
Kainaat Singh's user avatar
4 votes
1 answer
5k views

Android application fuzzing

How to do fuzzing in Android applications? Do we have any fuzzer specific to the android? Actually, I am looking for an easy way to do fuzzing while performing penetration testing of android ...
Mukesh's user avatar
  • 121
3 votes
1 answer
433 views

Questions about enabling special pool on win32k

So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10 Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
Jaewon Min's user avatar
2 votes
1 answer
99 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
alex's user avatar
  • 21
0 votes
1 answer
240 views

Is it possible to programmatically determine if a crash resulted from a buffer overflow?

Crash analysis: Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the ...
MrSynAckSter's user avatar
  • 1,258
1 vote
1 answer
334 views

iOS exploit hunting environment

Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
assp1r1n3's user avatar
9 votes
1 answer
465 views

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the ...
amccormack's user avatar
  • 1,326
2 votes
2 answers
420 views

Getting started with dynamic reverse engineering

I have been doing a lot of reading into how to find vulnerabilities in closed source applications. And the term that comes up a lot is "fuzzing". I want to get started with fuzzing and I looking for ...
Sreyan's user avatar
  • 203
3 votes
2 answers
218 views

blackbox vulnerability assessment

I wonder if the tools like AddressSanitizer exist for blackbox analysis. For instance I've fuzzer that can probe some 100 variants per second and after a few seconds crash was detected. Maybe some ...
see ya's user avatar
  • 823
1 vote
1 answer
266 views

Run multiple instances of same application - Adobe Reader

I have been fuzzing Adobe Reader for a while now. One of the issue that I face is running multiple instances of same application. If I'm able to run multiple instances of same application, I will be ...
john4tech's user avatar
  • 595
16 votes
3 answers
5k views

Code Coverage - Fuzzing

I have been fuzzing Adobe Reader lately. One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries. Is there any ...
john4tech's user avatar
  • 595
4 votes
2 answers
1k views

Corpus Distillation

Anyone know of any tools or scripts that can help in corpus distillation ? I know of Peach Minset, but not other than that. Appreciate if anyone could share.
d123's user avatar
  • 201
9 votes
2 answers
1k views

Setting an USB Emulation and Fuzzing Platform?

I would like to analyze (and fuzz) a USB device and I need a bit of guidance to setup a full platform to discuss with the device. First, I would like to know what are the most used hardware cards to ...
perror's user avatar
  • 19.1k
6 votes
3 answers
2k views

Fuzzing Adobe Reader - Exploit Development

I have been fuzzing Adobe Reader lately. I found couple of bugs. One of the major issues that I'm facing are listed below. How to identify the root cause of the issue? I mean, the PoC has a large ...
john4tech's user avatar
  • 595
1 vote
0 answers
180 views

Is there distributed fuzz testing platform against modern proprietary CPU like SETI@HOME? [closed]

My idea is near what SETI Institute does. Distributed fuzz testing against modern Intel and Amd Central processing units(CPU). To find similar to Blue Pill bugs. Is there?
Anomalous Awe's user avatar
2 votes
1 answer
134 views

Strange behavior in the reverse execution of traces

In fuzzing applications with Pin (the Pintool source code is hosted here, I am sorry for the self-advertisement), I get a very bizarre situation in tracing executed instructions, the following trace: ...
Ta Thanh Dinh's user avatar
4 votes
1 answer
326 views

Weird instructions

In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace: RIP register ...
Ta Thanh Dinh's user avatar
1 vote
0 answers
303 views

Where can i find unix/linux tool for fuzzing for kill-switches? [closed]

I'm looking for linux/unix open-source tools for fuzzing ethernet card for kill-switch packets. https://en.wikipedia.org/wiki/Fuzzing I can imagine how it would be long to brute full of range on ...
rezeptor's user avatar
15 votes
2 answers
4k views

Where can I learn more about black-box fuzzing of small embedded systems?

Fuzzing has become a very common place technique used for software testing and is heavily used to find security problems. There are many frameworks (sully, Peach Fuzzer etc.) that are geared up for ...
Cybergibbons's user avatar
  • 1,762
9 votes
1 answer
935 views

Context-Free Grammar from Samples

Is there a tool available that will generate a grammar from a corpus of sample inputs, similar to what HotFuzz does for network protocols? For example, given a collection of MP3 files, I'm looking ...
mrduclaw's user avatar
  • 4,066
12 votes
2 answers
852 views

How do I determine code coverage when fuzzing

Let's say I'd like to begin fuzzing Acme Corp's PDF Reader. I'd like to try to follow what Miller did by downloading a bunch of benign PDFs and mutate them. Miller began by reducing his corpus of ...
mrduclaw's user avatar
  • 4,066
7 votes
2 answers
2k views

State of the Art Fuzzing Framework [closed]

I've previously rolled my own Fuzzing Framework, and tried a few others like Peach Fuzzer. It's been awhile since I've looked at vulnerability hunting, what is the state of the art with regard to ...
mrduclaw's user avatar
  • 4,066