FuzzinatorIn bug we trust.
Renata HodovanAkos Kiss
HACKTIVITY 2
outlineWhy do you want to have a fuzzer?For a fuzzer framework, what is
… must have? … nice to have?
What does Fuzzinator have?How can you have more?
10/21/16
HACKTIVITY 3
Why do you want to fuzz?
10/21/16
HACKTIVITY 4
Why do you want to fuzz?Real issues
CrashesMemory corruptionsHangsAssertion failuresUnhandled exceptions
Reproducible issuesLarge amount of test cases with little effort
10/21/16
HACKTIVITY 5
Mandatory componentsSoftware Under TestingTest generatorTransfer mechanismMonitoring system
10/21/16
HACKTIVITY 6
Convenience functionalitiesRecognize unique issuesReduce test casesCustomize issue descriptionsReport issuesUpdate SUTs regularlySchedule multiple generators / SUTsUser friendly UI
10/21/16
HACKTIVITY 7
fuzzinatorGeneral fuzzer framework
Extra support for browsersBased on building blocksBuilding blocks are arbitrarily …
customizablereplaceable
Setup from config files
10/21/16
HACKTIVITY 8
Fuzzinator’s architecture
10/21/16
Controller
Update Job Reduce Job
SUT call
Fuzz Job
ReducerFuzzer
ISSUE
Updater
TEST
DB
HACKTIVITY 9
Building blocks – sut callsSubprocess callStream-monitored subprocess callStdin subprocess callTestRunner subprocess callPython callable
10/21/16
HACKTIVITY 10
Building blocks – SUT decoratorsExit code filterStream regex filterGDB backtrace decoratorPlatform info decoratorUnique ID decoratorAnonymize decoratorFile writer decorator
10/21/16
HACKTIVITY 11
Building blocks - fuzzersFuzzers
Random contentList directorySubprocess runnerAFL runnerPython callable
DecoratorTornado decorator
10/21/16
HACKTIVITY 12
Building blocks - reducersPicire (https://github.com/renatahodovan/picire)
ParallelLine or character based
Picireny (https://github.com/renatahodovan/picireny)ParallelGrammar based
10/21/16
HACKTIVITY 13
How to configure your fuzzer?Regular .ini syntaxSection types
SUT sectionsFuzz sectionsBuilding block parameter sectionsFuzzinator section
10/21/16
HACKTIVITY 14
Example test generatorsRandom content
fuzzinator.fuzzer.RandomContentGenerinator:RATS
Random Attributes, Tags & StyleGeneration based fuzzerhttps://github.com/renatahodovan/generinator-rats
10/21/16
15
Sut section
10/21/16 HACKTIVITY
[sut.webkit]call=fuzzinator.call.SubprocessCallcall.decorate(0)=fuzzinator.call.StreamRegexFiltercall.decorate(1)=fuzzinator.call.SubprocessPropertyDecoratorcall.decorate(2)=fuzzinator.call.PlatformInfoDecoratorreduce=fuzzinator.reduce.Picire
[sut.webkit.call]cwd=${webkit:path}command=./WebKitBuild/Debug/bin/MiniBrowser {test}
[sut.webkit.call.decorate(0)]stderr_patterns=["(?P<msg>ASSERTION FAILED: [^\n]+)\n(?P<file>[^()\n]+)", ...]
[sut.webkit.call.decorate(1)]property=versioncommand=git rev-parse --short HEADcwd=${webkit:path}
16
Fuzz section
10/21/16 HACKTIVITY
[fuzz.generinator_rats_webkit]sut=sut.webkitfuzzer=fuzzinator.fuzzer.SubprocessRunnerfuzzer.decorate(0)=fuzzinator.fuzzer.TornadoDecoratorbatch=100
[fuzz.generinator_rats_webkit.fuzzer.init]outdir=${fuzzinator:work_dir}/generinator_rats/{uid}command=generinator-rats -o ${outdir} -n ${fuzz.generinator_rats_webkit:batch}
[fuzz.generinator_rats_webkit.fuzzer.decorate(0)]port=8000
HACKTIVITY 17
Screenshot– main window
10/21/16
HACKTIVITY 18
Screenshot – report window
10/21/16
HACKTIVITY 19
contacts
10/21/16