3 ms·
What do fuzzers do in practice? (I am not up on the state of the art)? They try to explore edge cases, but how do they know what is likely to be an edge case?
by logicallee 10y ago
What do fuzzers do in practice? (I am not up on the state of the art)? They try to explore edge cases, but how do they know what is likely to be an edge case? Or how do they try to get coverage of their fuzzing?
- cnvogel 10y agoThey no longer just try out random combinations or cover the input space exhaustively (which is not feasible anyway). Nowadays they use instrumentation in the fuzzed/tested code to have guidance in what direction the input should be modified to get more cases the code covered. Good example: http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/
- caf 10y agoOne common technique (used by eg. AFL) is to instrument the program under test, so it can see when a different codepath has been triggered.