To debug a fuzzer (or anything really), I use this magical strace command:

strace -tt -yy -y -f -e trace=open,read,write,pipe,socket,dup2,clone,close -s 10000 -o /tmp/strace.log ./tool

• -tt enables microseconds
• -yy prints additional information about each file descriptor (like, files, sockets, etc.)
• -f follows forks (get all info about subprocesses, threads, etc.)
• -e trace= traces only specific syscalls we are interested in
• -s increases the max size of logged strings
• -o writes everything to /tmp/strace.log

Then, I can look at the log in vim or vscode, both with syntax hightlighting ( in vim, you may need to :set filetype=strace )

As additional weapon, I add -k which can dump a stacktrace at every syscall. Super slow, but super useful.

#fuzzing #fuzzingTips #debugging

The Mutiny Fuzzing Framework is a network fuzzer that operates by replaying network traffic through a mutational fuzzer. The goal is to begin network fuzzing as quickly as possible, at the expense of being thorough.

https://www.pycon.fr/2016/pages/programme.html#Python for SecOps: recherche de vulnérabilités dans les implémentations d'un protocole
Cette présentation s'attachera à illustrer l'emploi de bibliothèques Python dédiées à la rétro-conception de protocoles tels que Netzob et Pylstar. Il sera notamment présenté comment les utiliser pour 1) extraire la machine à états d'une implémentation en boite noire et 2) comparer les machines à états de plusieurs implémentations d'un même protocole pour rechercher des vulnérabilités. Le protocole HTTP2 servira d'exemple.

instrumentation-driven fuzzer for binary formats

American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary.

https://linuxfr.org/users/woffer/journaux/fuzzing-eprouver-les-entrees-de-vos-developpements

ernw, troopers, loki, l2spike

http://www.insinuator.net/tag/loki/
http://www.insinuator.net/2011/05/update-for-your-fuzzing-toolkit/

partie de virt-test

prez dtrace avec fuzzing ioctl
http://reverse.put.as/wp-content/uploads/2011/06/Dynamic-Tracing-for-Exploitation-and-Fuzzing-final.pdf

system call fuzzing
iknowthis Linux SystemCall Fuzzer https://code.google.com/p/iknowthis/
Trinity system call abuse http://codemonkey.org.uk/projects/trinity/
et la ml http://comments.gmane.org/gmane.comp.security.fuzzing.trinity/66
papier LCA: The Trinity fuzz tester https://lwn.net/Articles/536173/

https://rwmj.wordpress.com/2010/11/22/half-baked-ideas-feedback-directed-fuzz-testing-of-filesystems/