4 ms·

Afl-fuzz: crash exploration mode

31 points by pjf 12y ago

djmdjm 12y ago
afl is great - it is hands-down the most easy to use fuzzer I've ever played with and it managed to find a couple of (non-exploitable) crashes in OpenSSH that intensive human review and my own fuzzer missed. I can't recommend it highly enough - if you care about robustness, and especially if you write software that has to cope with untrusted input then please give it a try.
- rwmj 12y ago
  It is very good indeed. And just today we got it through the Fedora review process so within a few hours you should be able to do 'dnf install american-fuzzy-lop'. https://admin.fedoraproject.org/pkgdb/package/american-fuzzy-lop/ https://admin.fedoraproject.org/pkgdb/package/american-fuzzy...
- adestefan 12y ago
  I'd love to see it adapted for use as a fuzzer for network daemons. I have a couple ideas that mainly involve a separate driver from the binary to fuzz, but haven't dug too deeply into how to incorporate that.
0x0 12y ago
It's quite scary how even well reviewed open source software keeps falling to fuzzing. What are the chances of standing up against advanced state-sponsored trojans and malware? Seemingly zero. Is it time to throw out everything and start from scratch in a safer language?
- userbinator 12y ago
  I think it has to do with the fact that most software just never gets fuzzed. When "what's a fuzzer?" is the most common response I've had when talking to others about using one, followed by "why would you do that - we have test cases already" after explaining what it does, it's not hard to see why. There's a sort of malicious, "hacker"-like (in the pejorative sense) perception around useful security tools like fuzzers, password bruteforcers, port scanners, etc. which may be part of the reluctance too.
- rwmj 12y ago
  Yes, use safe languages when you can. On the other hand, we have all this software written in unsafe languages, but until afl came out we didn't have really effective, easy to use fuzzers.
  - 0x0 12y ago
    Actually zzuf http://caca.zoy.org/wiki/zzuf http://caca.zoy.org/wiki/zzuf has been around for like 7 years - and it's still pretty easy to find exploits with it.
    - the_why_of_y 12y ago
      CERT's BFF is also based on zzuf, and valgrind, very useful. http://www.cert.org/vulnerability-analysis/tools/bff.cfm http://www.cert.org/vulnerability-analysis/tools/bff.cfm http://www.cert.org/blogs/certcc/post.cfm?EntryID=53 http://www.cert.org/blogs/certcc/post.cfm?EntryID=53

31 points by pjf 12y ago

afl is great - it is hands-down the most easy to use fuzzer I've ever played with and it managed to find a couple of (non-exploitable) crashes in OpenSSH that intensive human review and my own fuzzer missed. I can't recommend it highly enough - if you care about robustness, and especially if you write software that has to cope with untrusted input then please give it a try.

rwmj 12y ago
It is very good indeed. And just today we got it through the Fedora review process so within a few hours you should be able to do 'dnf install american-fuzzy-lop'. https://admin.fedoraproject.org/pkgdb/package/american-fuzzy-lop/ https://admin.fedoraproject.org/pkgdb/package/american-fuzzy...
adestefan 12y ago
I'd love to see it adapted for use as a fuzzer for network daemons. I have a couple ideas that mainly involve a separate driver from the binary to fuzz, but haven't dug too deeply into how to incorporate that.

0x0 12y ago

It's quite scary how even well reviewed open source software keeps falling to fuzzing. What are the chances of standing up against advanced state-sponsored trojans and malware? Seemingly zero. Is it time to throw out everything and start from scratch in a safer language?

userbinator 12y ago
I think it has to do with the fact that most software just never gets fuzzed. When "what's a fuzzer?" is the most common response I've had when talking to others about using one, followed by "why would you do that - we have test cases already" after explaining what it does, it's not hard to see why. There's a sort of malicious, "hacker"-like (in the pejorative sense) perception around useful security tools like fuzzers, password bruteforcers, port scanners, etc. which may be part of the reluctance too.
rwmj 12y ago
Yes, use safe languages when you can. On the other hand, we have all this software written in unsafe languages, but until afl came out we didn't have really effective, easy to use fuzzers.
- 0x0 12y ago
  Actually zzuf http://caca.zoy.org/wiki/zzuf http://caca.zoy.org/wiki/zzuf has been around for like 7 years - and it's still pretty easy to find exploits with it.
  - the_why_of_y 12y ago
    CERT's BFF is also based on zzuf, and valgrind, very useful. http://www.cert.org/vulnerability-analysis/tools/bff.cfm http://www.cert.org/vulnerability-analysis/tools/bff.cfm http://www.cert.org/blogs/certcc/post.cfm?EntryID=53 http://www.cert.org/blogs/certcc/post.cfm?EntryID=53