Tutorial - Beginner's Guide to Fuzzing

[Nytro]

Tutorial - Beginner's Guide to Fuzzing

Part 1: Simple Fuzzing with zzuf

Part 1: zzuf ??

Part 2: Address Sanitizer ?? Part 3: american fuzzy lop

The goal of this tutorial is to get the message out that fuzzing is really simple. Many free software projects today suffer from bugs that can easily be found with fuzzing. This has to change and I hope we can make fuzzing an integral part of most project's development process. What fuzzing does is that we feed an application with a large number of malformed inputs and look for undesired behaviour, e. g. crashes. We usually do this by taking a valid input and add random errors to it.

Promising fuzzing targets are tools that provide parsers for a large number of exotic file formats. Let's take ImageMagick as an example. It's a set of command line tools that process images in a large number of file formats.

How do we fuzz it? We start by generating some input samples. It's usually a good idea to fuzz with small files, so first we create a simple image in any format with small dimensions, e.g. a 3x3 pixel PNG. We'll name that example.png Now we convert that into various other file formats. In this case you can just use ImageMagick itself or more precisely the tool convert that is part of ImageMagick to create your example files:

convert example.png example.gif

convert example.png example.xwd

convert example.png example.tga

Use as many as you like (convert -list format will show you all supported formats). Now we need malformed versions of these example files. Here we start using the tool zzuf. It's a simple fuzzing tool and is available in most Linux distributions.

Articol complet: https://fuzzing-project.org/tutorial1.html