Write Fuzzable Code

Re:Write Fuzzable Code by d33 on Thursday August 29, 2019 @12:16PM (#20830853)

Speaking of fuzzing, does anybody know of a solution for fuzzing multi-step processes? Suppose I was fuzzing a network application, which requires an entire session for a bug to be discovered. I can't do that with vanilla afl-fuzz; what tool would enable me to fuzz, say, an SSL/TLS library?

[ Parent | on HN ]

Re:Write Fuzzable Code by wyldfire on Thursday August 29, 2019 @01:35PM (#20831755)

> Suppose I was fuzzing a network application, which requires an entire session for a bug to be discovered

I/O is a general problem for fuzzing and IMO the simplest/most general approach is to try and decompose the code under test to find a part that is able to accept a single input stream.

EDIT: e.g. for an SSL/TLS library -- if you had a

    bool msg_create(msg_t *msg, void *input, size_t len_bytes)

function, you could fuzz that one easily.

[ Parent | on HN ]

Re:Write Fuzzable Code by caf on Friday August 30, 2019 @12:59AM (#20836069)

For something like an SSL/TLS library, you could have a fuzzing mode that sets the initial randomness to a fixed value. That lets you create a pre-baked input file that can successfully establish a session, and you'd start the fuzzing from there.

You can do the same thing with session IDs or similar. In general when you're fuzzing you want to fix your random seeds (and date/time inputs etc, as well as reset any external data store modified by the program back to initial conditions) - ideally your program being fuzzed is a pure function of its input.

[ Parent | on HN ]

Re:Write Fuzzable Code by agroce on Thursday August 29, 2019 @02:34PM (#20832329)

If you want to fuzz a library by making a series of calls, DeepState has special support for that, but that won't handle some other issues with network applications of course.

[ Parent | on HN ]