Fuzzing TCP servers
Intro The architectures of software fuzzing setups that authors of security fuzzing tools had originally implemented were fairly simple. In early days of security fuzzing (before 2010) the vast majority of fuzzing engines were writing mangled content to disk files, and then instructed fuzzed binaries where to find them: $ honggfuzz -f INPUT_DIRECTORY -- /usr/bin/djpeg ___FILE___ Here, the placehol
libFuzzer – a library for coverage-guided fuzz testing. — LLVM 19.0.0git documentation
libFuzzer – a library for coverage-guided fuzz testing.¶ Introduction¶ LibFuzzer is an in-process, coverage-guided, evolutionary fuzzing engine. LibFuzzer is linked with the library under test, and feeds fuzzed inputs to the library via a specific fuzzing entrypoint (aka “target function”); the fuzzer then tracks which areas of the code are reached, and generates mutations on the corpus of input d
Linux containers in 500 lines of code
I've used Linux containers directly and indirectly for years, but I wanted to become more familiar with them. So I wrote some code. This used to be 500 lines of code, I swear, but I've revised it some since publishing; I've ended up with about 70 lines more. I wanted specifically to find a minimal set of restrictions to run untrusted code. This isn't how you should approach containers on anything
american fuzzy lop
American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code. The compact synthesized corpora produced by the tool are also useful for seeding oth
The Fuzzing Project - Background
Fuzzing is a powerful strategy to find bugs in software. The idea is quite simple: Generate a large number of randomly malformed inputs for a software to parse and see what happens. If the program crashes then something is likely wrong. While fuzzing is a well-known strategy, it is surprisingly easy to find bugs, often with security implications, in widely used software. Memory access errors are t
The Metasploit Project by H.D. Moore
The world’s most used penetration testing framework Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.
fuzzdb - Project Hosting on Google Code
FuzzDB was created to increase the likelihood of finding application security vulnerabilities through dynamic application security testing. It's the first and most comprehensive open dictionary of fault injection patterns, predictable resource locations, and regex for matching server responses. Attack Patterns - FuzzDB contains comprehensive lists of attack payload primitives for fault injection t
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
GitHub - hunter-ht-2018/ptfuzzer: Improving AFL by using Intel PT to collect branch information
Evaluating Fuzz Testing
GitHub - sslab-gatech/perf-fuzz
GitHub - oracle/kernel-fuzzing: Fuzzers for the Linux kernel
GitHub - sslab-gatech/unisan: UniSan: Proactive Kernel Memory Initialization to Eliminate Data Leakages
GitHub - HexHive/T-Fuzz
GitHub - mc-imperial/jfs: Constraint solver based on coverage-guided fuzzing
GitHub - jdbirdwell/afl: american fuzzy lop for network fuzzing (unofficial) -- official afl site is http://lcamtuf.coredump.cx/afl/
GitHub - kernelslacker/trinity: Linux system call fuzzer
GitHub - google/syzkaller: syzkaller is an unsupervised coverage-guided kernel fuzzer
GitHub - minimaxir/big-list-of-naughty-strings: The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
GitHub - google/honggfuzz: Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
GitHub - CoolerVoid/0d1n: Tool for automating customized attacks against web applications. Fully made in C language with pthreads, it has fast performance.