Smart Greybox Fuzzing

Abstract

Coverage-based greybox fuzzing (CGF) is one of the most successful methods for automated vulnerability detection. Given a seed file (as a sequence of bits), CGF randomly flips, deletes or bits to generate new files. CGF iteratively constructs (and fuzzes) a seed corpus by retaining those generated files which enhance coverage. However, random bitflips are unlikely to produce valid files (or valid chunks in files), for applications processing complex file formats.In this work, we introduce smart greybox fuzzing (SGF) which leverages a high-level structural representation of the seed file to generate new files. We define innovative mutation operators that work on the virtual file structure rather than on the bit level which allows SGF to explore completely new input domains while maintaining file validity. We introduce a novel validity-based power schedule that enables SGF to spend more time generating files that are more likely to pass the parsing stage of the program, which can expose vulnerabilities much deeper in the processing logic.Our evaluation demonstrates the effectiveness of SGF. On several libraries that parse structurally complex files, our tool AFLSMART explores substantially more paths (up to 200%) and exposes more vulnerabilities than baseline AFL. Our tool AFLSMART has discovered 42 zero-day vulnerabilities in widely-used, well-tested tools and libraries; so far 17 CVEs were assigned.

Fuzzing With Optimized Grammar-Aware Mutation Strategies

“…Markov chain, PSO and MAB) to help energy assignment. Note that AFLSmart [24] leverages the structure representation in seed files to guide mutation, and defines a validity-based power schedule to generate test inputs that are more likely to explore deeper program logic. Although it is close to main ideas of grammar-based and generationbased fuzzers, its application scenarios are limited due to the relatively simple chunk strategy and virtual file structure.…”

“…While, in classic mutation-based fuzzers, the influence of mutation priority and frequency has been proved to be significant ( [1] [19] [21]). Many mutation-based fuzzers have developed different approaches to optimize power schedule, such as reducing the search space of inputs ( [16], [19], [21], [23]), or modeling the process of power schedule ( [17], [18], [24]).…”

SGPFuzzer: A State-Driven Smart Graybox Protocol Fuzzer for Network Protocol Implementations

“…Based on RedQueen [32], Grimoire [33] identifies fragments from an initial set of inputs that trigger new coverage, strips them and later splices in other parts, thus mimicking grammar combinations. Chunk-based fuzzers such as Peach [8] and AFLSmart [34] generate inputs following a tree hierarchy, using C structure-like data chunks to form individual nodes. Peach applies format-aware mutations to the initial valid input set through a user-defined input specification (called a "peach pit file").…”

Assurances in Software Testing: A Roadmap

“…The STADS framework [15] is general in the sense that it does not depend on a specific programming language, or execution environment, testing objective, or test generation technique. For instance, STADS facilitates the extrapolation of statement coverage, mutation adequacy, or the number of bugs exposed for Java, C, and Python programs on Linux, Windows, and MacOS using CSmith [29], Randoop [30], or AFL [31]- [34].…”