Questions tagged [fuzzing]
A software testing technique that involves providing invalid, unexpected, or random data to the inputs of a computer system, then monitoring for exceptions, failed assertions, or memory leaks.
27 questions
1
vote
0
answers
59
views
Fuzzing closed application
I want to get from you some advice about fuzzing.
I am checking a huge C application (not open source) which is also an HTTP server.
My purpose is to fuzz the HTTP server via the requests being sent ...
- 11
15
votes
2
answers
11k
views
What are some ways to pass raw bytes to a program via the Linux terminal?
I want to pass raw bytes to a (C) program using the Linux Bash shell. I find that when I try to pass for example "\x00\xFF\xAB", the program receiving the input actually gets the ASCII character codes ...
- 1,880
1
vote
1
answer
374
views
Approach for fuzzing interactive CLI
I have an IoT system that has a command-line-based interactive shell that can be used to configure the system. While examining the disassembly/decompilation, I realized that there is a lot of ...
- 609
2
votes
2
answers
191
views
Modern methods of fuzzing/locating heap bugs and potential vulnerabilites
really glad I found this great learning resource.
I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
- 21
2
votes
0
answers
202
views
submitting input into AFL fuzzer
I have some questions about the AFL Fuzzer:
How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?...
- 71
-1
votes
1
answer
346
views
Fuzz Test Suite for C/C++ Command Line Argument/Standard Input programs
I have implemented a basic coverage guided fuzzer that is sending inputs to programs accepting ONE command line argument or ONE standard input. I am trying to find a complex code to fuzz that can meet ...
4
votes
1
answer
5k
views
Android application fuzzing
How to do fuzzing in Android applications? Do we have any fuzzer specific to the android?
Actually, I am looking for an easy way to do fuzzing while performing penetration testing of android ...
- 121
3
votes
1
answer
437
views
Questions about enabling special pool on win32k
So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10
Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
- 329
2
votes
1
answer
100
views
Detect interesting testcases
Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
- 21
0
votes
1
answer
242
views
Is it possible to programmatically determine if a crash resulted from a buffer overflow?
Crash analysis:
Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the ...
- 1,258
1
vote
1
answer
336
views
iOS exploit hunting environment
Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
- 53
9
votes
1
answer
466
views
Saving program execution state for fuzzing
Suppose I have a program that has two functions, functionA and functionB called sequentially.
functionA requires a significant amount of processing in order to execute, and in the course of the ...
- 1,326
2
votes
2
answers
441
views
Getting started with dynamic reverse engineering
I have been doing a lot of reading into how to find vulnerabilities in closed source applications. And the term that comes up a lot is "fuzzing".
I want to get started with fuzzing and I looking for ...
- 203
3
votes
2
answers
219
views
blackbox vulnerability assessment
I wonder if the tools like AddressSanitizer exist for blackbox analysis.
For instance I've fuzzer that can probe some 100 variants per second and after a few seconds crash was detected. Maybe some ...
- 823
1
vote
1
answer
267
views
Run multiple instances of same application - Adobe Reader
I have been fuzzing Adobe Reader for a while now.
One of the issue that I face is running multiple instances of same application. If I'm able to run multiple instances of same application, I will be ...
- 595
16
votes
3
answers
5k
views
Code Coverage - Fuzzing
I have been fuzzing Adobe Reader lately.
One of the issues that I face is Code coverage. How do I determine that I have covered all the basic blocks in Adobe Reader and it's libraries.
Is there any ...
- 595
4
votes
2
answers
1k
views
Corpus Distillation
Anyone know of any tools or scripts that can help in corpus distillation ? I know of Peach Minset, but not other than that. Appreciate if anyone could share.
- 201
9
votes
2
answers
1k
views
Setting an USB Emulation and Fuzzing Platform?
I would like to analyze (and fuzz) a USB device and I need a bit of guidance to setup a full platform to discuss with the device.
First, I would like to know what are the most used hardware cards to ...
- 19.2k
6
votes
3
answers
2k
views
Fuzzing Adobe Reader - Exploit Development
I have been fuzzing Adobe Reader lately. I found couple of bugs.
One of the major issues that I'm facing are listed below.
How to identify the root cause of the issue? I mean, the PoC has a large ...
- 595
1
vote
0
answers
180
views
Is there distributed fuzz testing platform against modern proprietary CPU like SETI@HOME? [closed]
My idea is near what SETI Institute does.
Distributed fuzz testing against modern Intel and Amd Central processing units(CPU).
To find similar to Blue Pill bugs.
Is there?
2
votes
1
answer
135
views
Strange behavior in the reverse execution of traces
In fuzzing applications with Pin (the Pintool source code is hosted here, I am sorry for the self-advertisement), I get a very bizarre situation in tracing executed instructions, the following trace:
...
- 1,410
4
votes
1
answer
327
views
Weird instructions
In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace:
RIP register ...
- 1,410
1
vote
0
answers
309
views
Where can i find unix/linux tool for fuzzing for kill-switches? [closed]
I'm looking for linux/unix open-source tools for fuzzing ethernet card for kill-switch packets.
https://en.wikipedia.org/wiki/Fuzzing
I can imagine how it would be long to brute full of range on ...
- 35
15
votes
2
answers
4k
views
Where can I learn more about black-box fuzzing of small embedded systems?
Fuzzing has become a very common place technique used for software testing and is heavily used to find security problems. There are many frameworks (sully, Peach Fuzzer etc.) that are geared up for ...
- 1,762
9
votes
1
answer
938
views
Context-Free Grammar from Samples
Is there a tool available that will generate a grammar from a corpus of sample inputs, similar to what HotFuzz does for network protocols?
For example, given a collection of MP3 files, I'm looking ...
- 4,066
12
votes
2
answers
861
views
How do I determine code coverage when fuzzing
Let's say I'd like to begin fuzzing Acme Corp's PDF Reader. I'd like to try to follow what Miller did by downloading a bunch of benign PDFs and mutate them.
Miller began by reducing his corpus of ...
- 4,066
7
votes
2
answers
2k
views
State of the Art Fuzzing Framework [closed]
I've previously rolled my own Fuzzing Framework, and tried a few others like Peach Fuzzer. It's been awhile since I've looked at vulnerability hunting, what is the state of the art with regard to ...
- 4,066