Fuzzing
Automated software testing technique that involves feeding pseudo-randomly generated input data.
Contents
Papers
https://beerkay.github.io/papers/Berkay2021PGFuzzNDSS.pdf
https://lifeasageek.github.io/papers/han:meds.pdf
https://www.unexploitable.systems/publication/kimhfl/
https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2020/02/07/Hyper-Cube-NDSS20.pdf
IEEE Symposium on Security and Privacy (IEEE S&P)
USENIX Security
ACM Conference on Computer and Communications Security (ACM CCS)
ArXiv (Fuzzing with Artificial Intelligence & Machine Learning)
Tools
File
AFL++ is a superior fork to Google's AFL - more speed, more and better mutations, more and better instrumentation, custom module support, etc.
Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
API
MINER is a REST API fuzzer that utilizes three data-driven designs working together to guide the sequence generation, improve the request generation quality, and capture the unique errors caused by incorrect parameter usage.
RestTestGen is a robust tool and framework designed for automated black-box testing of RESTful web APIs.
GraphFuzz is an experimental framework for building structure-aware, library API fuzzers.
Minerva is a browser fuzzer augmented by API mod-ref relations, aiming to synthesize highly-relevant browser API invocations in each test case.
FANS is a fuzzing tool for fuzzing Android native system services. It contains four components: interface collector, interface model extractor, dependency inferer, and fuzzer engine.
CPU
DifuzzRTL is a differential fuzz testing approach for CPU verification.
MorFuzz is a generic RISC-V processor fuzzing framework that can efficiently detect software triggerable functional bugs.
SpecFuzz is a tool to enable fuzzing for Spectre vulnerabilities
Transynther automatically generates and tests building blocks for Meltdown attacks with various faults and microcode assists.
Web
TEFuzz is a tailored fuzzing-based framework to facilitate the detection and exploitation of template escape bugs.
Witcher is a web application fuzzer that utilizes mutational fuzzing to explore web applications and fault escalation to detect command and SQL injection vulnerabilities.
CorbFuzz is a state-aware fuzzer for generating as much reponses from a web application as possible without need of setting up database, etc.