Fuzz Station

Ship Fuzzed C / C++ Faster

Jan 4, 2018

Fuzz Stati0n Pivots to Node JS

Do you drive a car or use a smart phone? If so, every day you run a vast amount of software — over 100 million lines of code. We live in a software dominated world and with the growth of AI, self driving vehicles and IoT (Internet of Things) skyrocketing, a massive amount of…

David Moore in Fuzz Stati0n

Oct 2, 2017

Preparing an Application for AFL-Fuzz

To fuzz test a C or C++ application for security vulnerabilities and crashes there are a few things that should happen first:

Select an application appropriate for fuzz testing. The program should be written in C or C++ and process input…

David Moore in Fuzz Stati0n

Sep 21, 2017

What is “Continuous Fuzzing”?

Fuzz testing is a dynamic technique that bombards a target application with crafted input to force the execution of unanticipated paths, leading to potentially exploitable crashes. Recently, new, groundbreaking “smart” fuzzers such as AFL and libFuzzer have proven very…

1 response

David Moore in Fuzz Stati0n

Sep 13, 2017

Breaking Ruby’s Unmarshal with AFL-Fuzz

I found an integer overflow in the rb_str_modify_expand()function (fromstring.c)of the Ruby MRI interpreter by fuzzing the Marshal.load function with the killer AFL (American Fuzzy Lop) fuzzer. Please see the full bug report here.

9 responses

David Moore in Fuzz Stati0n

Sep 1, 2017

Fuzz Testing: Choosing a Seed File for AFL

Mutational fuzzers such as AFL require an initial input file — this file will be mutated many times by the fuzzer in an effort to find bugs by forcing the execution of unexpected paths through the target application.