3 ms·
in general, have a poke around https://fuzzing.info/papers/ https://fuzzing.info/papers/ First, I think the next big step in fuzzing will actually be a complem
by wepple 10y ago
in general, have a poke around https://fuzzing.info/papers/ https://fuzzing.info/papers/
First, I think the next big step in fuzzing will actually be a complement to fuzzing - solving.
AFL and friends can bitbang their way to massive code coverage, but can still fail on fairly simple testcases. Some recent research[1] by the authors of Angr[2] show that by pairing the brute-force coverage and exception discovery of a tool like AFL with constraint solving tools can really dig deep into a program, by actually solving the path to a given block of code. Microsoft's infamous SAGE fuzzer does this IIRC.
Second, I think there are still massive oportunities for fuzzing closed-source programs, as well as programs with tricky state, such as browsers or network daemons.
[1] https://www.internetsociety.org/sites/default/files/blogs-media/driller-augmenting-fuzzing-through-selective-symbolic-execution.pdf https://www.internetsociety.org/sites/default/files/blogs-me...
[2] http://angr.io http://angr.io
- grandpa 10y agoWhy "infamous"?
- wepple 10y agoI have no idea why I wrote that, bad wording.
- joosters 10y agoHas anyone tried combining fuzzing with 'all-pairs'/'pairwise' test case generation? The idea of pairwise testing is that individual features in a program are commonly tested, but combinations of them are often poorly tested. However, trying to test all features with each other soon becomes a combinatorial nightmare. To deal with this, you use an algorithm (e.g. see the code for 'allpairs' at http://www.satisfice.com/tools.shtml http://www.satisfice.com/tools.shtml ) to pick a minimal set of test cases that cover all possible pairs of configuration settings. These test cases could then be used as starting points for fuzzing, to provide a greater code coverage faster.
- wyldfire 10y agoNIST has done some research on combinatorial software testing and has a pretty good package [1] I've used before for generating test cases given N dimensions. The idea behind their software is to maximize the effectiveness of test time because testing those N dimensions exhaustively is infeasible. [1] http://csrc.nist.gov/groups/SNS/acts/index.html http://csrc.nist.gov/groups/SNS/acts/index.html
- yeukhon 10y agoI recommend https://www.usenix.org/search/site/fuzzing https://www.usenix.org/search/site/fuzzing. ACM library is fine as well, although I find more security-related journals in USENIX database.
- jmgrosen 10y agoI'm the second author on [1], if anyone has any questions.
- Natsu 10y agoThank you. Things like this are what make HN awesome :)