Jazzer brings modern fuzz testing to the JVM

Re:Jazzer brings modern fuzz testing to the JVM by layer8 on Wednesday February 10, 2021 @04:01PM (#26094743)

I couldn’t find any information on what specific kinds of errors are recognized (except JNI memory handling), or how (mechanism) one specifies to the tool what constitutes an error. Can you shed some light on that, or give a pointer to relevant documentation?

[ Parent | on HN ]

Re:Jazzer brings modern fuzz testing to the JVM by fhenneke on Thursday February 11, 2021 @02:32AM (#26099153)

By default, uncaught exceptions and memory issues in JNI libraries are reported as "crashes".

Additionally, Jazzer provides a hooking framework that can be used to implement domain-specific sanitizers for logic bugs. See https://blog.code-intelligence.com/engineering-jazzer#user-c... for an example. Part of the reason for open-sourcing Jazzer has been to get the discussion started on what kind of "sanitizers" are needed to unlock the full potential of Java fuzzing.

[ Parent | on HN ]

Re:Jazzer brings modern fuzz testing to the JVM by layer8 on Thursday February 11, 2021 @06:35AM (#26100439)

Thanks!

[ Parent | on HN ]

Re:Jazzer brings modern fuzz testing to the JVM by fhenneke on Thursday February 11, 2021 @05:36AM (#26100106)

If you want to fuzz a Java web app, our commercial platform CI Fuzz (of which Jazzer is one part) has built-in detectors for the typical vulnerabilities such as SQL injections: https://blog.code-intelligence.com/sql-fuzzing

[ Parent | on HN ]