serjd

One of the organizers here: we're going to open-source further parts of Jazzer making it possible to detect OWASP issues like SQL injections...

One of the speakers here: we also are going to open-source further parts of Jazzer making it possible to detect OWASP issues.

We use our internal grammar generator similar to libprotobuf mutator. For the OSS solution, we recommend to use libprotobuf mutator though. The reason to abstract this is that we don't want to write the grammars for a single programming language only.

In pitest mutations are seeded into your code, then your tests are run. The assumption is: If your unit test don't fail after changed code, it may indicate an issue with the test suite.

In fuzz testing, the mutations are seeded into the inputs. Depending on the fuzzing approach, those might be seeded from random, patterns, application behavior, etc. Jazzer is based on libFuzzer, meaning that it's feedback-loop is based on which coverage metrics are reported during run-time.

Integrating important JVM projects is work in progress ;-)

We are aware of JQF and the jUnit integration is the best part there. We opted to taking the "Fuzzed Data Provider" approach to be more compatible to the approach in C/C++, Go and Python...

Maybe a bit biased opinion here, but you could start with this blog post, and see whether you go more into C/C++ fuzzing or web fuzzing from there:

https://blog.code-intelligence.com/the-magic-behind-feedback...

https://github.com/google/fuzzing

> We reported the issue to Microsoft. They did not consider it a vulnerability, but fixed it

Seems like Microsoft doesn't like to pay for a bug bounty