Nytro Posted December 4, 2014 Report Posted December 4, 2014 [h=1]american fuzzy lop (0.85b)[/h] American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code. The compact synthesized corpora produced by the tool are also useful for seeding other, more labor- or resource-intensive testing regimes down the road. Compared to other instrumented fuzzers, afl-fuzz is designed to be practical: it has modest performance overhead, uses a variety of highly effective fuzzing strategies, requires essentially no configuration, and seamlessly handles complex, real-world use cases - say, common image parsing or file compression libraries. [h=2]The "sales pitch"[/h] In a hurry? There are several fairly decent reasons to give afl-fuzz a try: It is pretty sophisticated. It's an instrumentation-guided genetic fuzzer capable of synthesizing complex file semantics in a wide range of non-trivial targets, lessening the need for purpose-built, syntax-aware tools. It also comes with a unique crash explorer to make it dead simple to evaluate the impact of crashing bugs. It has street smarts. It is built around a range of carefully researched, high-gain test case preprocessing and fuzzing strategies rarely employed with comparable rigor in other fuzzing frameworks. As a result, it finds real bugs. It is fast. Thanks to its low-level compile-time instrumentation and other optimizations, the tool offers near-native fuzzing speeds against common real-world targets. For example, you can get 2,500+ execs per second per core with libpng. It's rock solid. Compared to other instrumentation- or solver-based fuzzers, it has remarkably few failure modes. It also comes with robust, user-friendly problem detection that guides you through any potential hiccups. No tinkering required. In contrast to most other fuzzers, the tool requires essentially no guesswork or fine-tuning. Even if you wanted to, you will find virtually no knobs to fiddle with and no "fuzzing ratios" to dial in. It's chainable to other tools. The fuzzer generates superior, compact test corpora that can serve as a seed for more specialized, slower, or labor-intensive processes and testing frameworks. It sports a hip, retro-style UI. Just scroll back to the top of the page. Enough said. Want to try it out? Check out the documentation or grab the source code right away. [h=2]The bug-o-rama trophy case[/h] The fuzzer is still under active development, and I have not been running it very systematically or at a scale. Still, based on user reports, it seems to have netted quite a few notable vulnerabilities and other uniquely interesting bugs. Some of the "trophies" that I am aware of include: [TABLE] [TR] [TD]IJG jpeg 1 [/TD] [TD]libjpeg-turbo 1 2 [/TD] [TD]Mozilla Firefox 1 2 3 4 [/TD] [/TR][TR] [TD]Google Chrome 1 [/TD] [TD]Internet Explorer 1 2 [/TD] [TD]bash (post-Shellshock) 1 2 [/TD] [/TR][TR] [TD]GnuTLS 1 [/TD] [TD]GnuPG 1 2 [/TD] [TD]OpenSSH 1 2 3 [/TD] [/TR][TR] [TD]FLAC audio library 1 [/TD] [TD]tcpdump 1 2 3 4 5 6 [/TD] [TD]dpkg 1 [/TD] [/TR][TR] [TD]systemd-resolved 1 2 [/TD] [TD]strings (+ related tools) 1 2 3 4 5 6 7 [/TD] [TD]less / lesspipe 1 2 3 [/TD] [/TR][TR] [TD]rcs 1 [/TD] [TD]OpenBSD pfctl 1 [/TD] [TD]man & mandoc 1 [/TD] [/TR][TR] [TD]libyaml 1 [/TD] [TD]Info-Zip unzip 1 [/TD][TD]procmail 1 [/TD] [/TR][TR] [TD]libsndfile 1 2 3 [/TD] [TD]fwknop[/TD] [TD]mutt 1 [/TD] [/TR] [/TABLE] Plus, probably, quite a few other things that weren't attributed to the tool and that I have no way of knowing about. [h=2]Download & other useful links[/h] Here's a collection of useful links related to afl-fuzz: Current and past releases of the tool (changes),Online copy of the README file,Description of the status screen,Generated test cases for common image formats,Notes on the inspiration and design goals for afl-fuzz. The tool is confirmed to work on x86 Linux, OpenBSD, FreeBSD, and NetBSD, both 32- and 64-bit. It should also work on MacOS X and Solaris, although with some constraints. It supports programs written in C, C++, or Objective C, compiled with either gcc or clang. Java programs compiled with GCJ can be supported with very little effort. If you are honestly interested, ping me and I'll help you set it up. For fuzzing Python, you may want to check out this module from Jakub Wilk. To send bug reports, feature requests, or chocolate, simply drop a mail to lcamtuf@coredump.cx. Sursa: american fuzzy lop Quote
