Fuzzing
Automated software testing technique that involves feeding pseudo-randomly generated input data.
Contents
Papers
https://beerkay.github.io/papers/Berkay2021PGFuzzNDSS.pdf
https://lifeasageek.github.io/papers/han:meds.pdf
https://www.unexploitable.systems/publication/kimhfl/
https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2020/02/07/Hyper-Cube-NDSS20.pdf
https://chenbihuan.github.io/paper/ccs18-chen-hawkeye.pdf
https://dl.acm.org/citation.cfm?id=2094081
https://dl.acm.org/citation.cfm?id=1555061
https://dl.acm.org/citation.cfm?id=1375607
2022 (5 papers)
USENIX Security
ACM Conference on Computer and Communications Security (ACM CCS)
ArXiv (Fuzzing with Artificial Intelligence & Machine Learning)
The Network and Distributed System Security Symposium (NDSS)
2018 (2 papers)
2021 (8 papers)
2017 (7 papers)
Tools
File
A superior fork to Google's AFL with more speed, more and better mutations, more and better instrumentation, and custom module support.
A mutation-based coverage guided fuzzer that increases branch coverage by solving path constraints without symbolic execution.
API
A REST API fuzzer that utilizes three data-driven designs working together to guide sequence generation, improve request generation quality, and capture unique errors caused by incorrect parameter usage.
A robust tool and framework designed for automated black-box testing of RESTful web APIs.
An experimental framework for building structure-aware, library API fuzzers.
A browser fuzzer augmented by API mod-ref relations, aiming to synthesize highly-relevant browser API invocations in each test case.
FANS is a fuzzing tool for fuzzing Android native system services. It contains four components: interface collector, interface model extractor, dependency inferer, and fuzzer engine.
A fuzzing tool for Android native system services with four components: interface collector, interface model extractor, dependency inferer, and fuzzer engine.
CPU
A differential fuzz testing approach for CPU verification.
A generic RISC-V processor fuzzing framework that can efficiently detect software triggerable functional bugs.
A tool to enable fuzzing for Spectre vulnerabilities.
Automatically generates and tests building blocks for Meltdown attacks with various faults and microcode assists.
Web
A tailored fuzzing-based framework to facilitate the detection and exploitation of template escape bugs.
A web application fuzzer that utilizes mutational fuzzing to explore web applications and fault escalation to detect command and SQL injection vulnerabilities.
A state-aware fuzzer for generating as many responses from a web application as possible without need of setting up a database.
Blockchain
Kernel
(2023) - An action-guided kernel fuzzing framework that generates inputs leveraging triggered actions and their temporal relationships.
(2021) - A type-aware Windows kernel fuzzer that statically analyzes system binaries to infer system call types for more effective fuzzing.
(2020) - A coverage-guided fuzzing framework that detects data races in kernel file systems by exploring concurrency through multi-threaded syscall sequences.
(2019) - A kernel fuzzer that uses static analysis and two-phase fuzzing to detect race conditions and concurrency bugs in Linux kernels.
(2019) - A fuzzing framework for automatically discovering semantic bugs in file systems using input mutators, feedback engines, and customizable checkers.
(2019) - A file system fuzzer that finds memory corruptions in Linux kernel file systems by mutating both filesystem images and syscall sequences simultaneously.
(2017) - An interface-aware fuzzer for Linux kernel drivers that automatically recovers ioctl interfaces via LLVM analysis and generates targeted test cases.
(2017) - A kernel API fuzzer that leverages automated API model inference to discover vulnerabilities in macOS kernel APIs.
(2017) - A hardware-assisted x86-64 VM kernel fuzzing framework with performant VM reloads for finding OS kernel vulnerabilities.
(2015) - An unsupervised coverage-guided kernel fuzzer supporting FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, and Windows.
(2012) - A Linux system call fuzzer that generates semi-intelligent random arguments to syscalls, including valid file descriptors, flags, and range-biased values.