Hi r/fuzzing! In our latest blog post, we introduce coverage-guided fuzzing with a brief description of fundamentals and a demonstration of how modifying program instrumentation can be used to more easily track down the source of vulnerabilities and identify interesting fuzzing paths.

https://blog.includesecurity.com/2024/04/coverage-guided-fuzzing-extending-instrumentation/

Has anybody had success fuzzing Go? What kind of vulnerabilities do you find?

Hi everyone,

I'm currently exploring the world of fuzz testing, particularly within the context of CNCF projects, and I could use some guidance from the community. I'm interested in contributing to CNCF projects through fuzz testing, but I'm feeling a bit overwhelmed and could use some clarification on a few points.

Specifically, I'm curious about:

• How fuzz testing is typically integrated into CNCF projects.
• Best practices for identifying fuzzing targets within large codebases.
• Strategies for prioritizing fuzzing efforts to maximize impact.
• Any resources or tools that are commonly used for fuzz testing in CNCF projects.

If anyone in the community has experience with fuzz testing in CNCF projects or has insights to share on the topic, I would greatly appreciate your guidance. Whether it's advice, recommended reading materials, or even just sharing your own experiences, any help would be immensely valuable to me as I embark on this learning journey.

Thank you in advance for your support and expertise!

Hi. I’m an undergraduate student in cyber security. I have a final assignment that requires me to carry out an information security project and then report the result to the teacher. Currently, I’m thinking about performing fuzzing for an open source software written in C++ (because that’s the language I use the most) then figure out where the program’s errors are and how to fix them. I’m a newbie so I dont know how to perform fuzzing. Can you show me the main steps to do it and some source code for reference? Thanks a lot and have a good day.

I am very new to fuzzing and I'm just getting started but I would like to gain a better understanding and would like to know if there are any resources for beginners to get started on and gain a better understanding.
I'm trying to write fuzztests for a set of functions that are designed to handle most INT and FLOAT types as element values and accept Tensors as arguments.

Hello everyone,

I'm new to fuzzing, and for my first project, I chose to fuzz FFmpeg. I've encountered two vulnerabilities, but I'm struggling to understand them. When I try to build FFmpeg with debugging options and ASan, the debug options seem to be stripped away, and the new build doesn't reproduce the crash; instead, it throws an error 'Error opening output file -.' which didn't occur in the AFL++-fuzzed build.

Here's the configuration I used for fuzzing with AFL++:

./configure \   --prefix="$HOME/ffmpeg_build" \   --pkg-config-flags="--static" \   --extra-cflags="-I$HOME/ffmpeg_build/include" \   --extra-ldflags="-L$HOME/ffmpeg_build/lib" \   --extra-libs="-lpthread -lm" \   --bindir="$HOME/bin" \   --enable-gpl \   --enable-libass \   --enable-libfreetype \   --enable-libmp3lame \   --enable-libopus \   --enable-libvorbis \   --enable-libx264 \   --enable-libx265 \   --enable-nonfree \   --cc=/home/kali/AFLplusplus/afl-clang-lto \   --cxx=/home/kali/AFLplusplus/afl-clang-lto++ \   --extra-cflags="-I$HOME/ffmpeg_build/include -O1 -fno-omit-frame-pointer -g" \   --extra-cxxflags="-O1 -fno-omit-frame-pointer -g" \   --extra-ldflags="-L$HOME/ffmpeg_build/lib" \   --enable-lto \   --disable-inline-asm \   --enable-debug 

And for the ASan build:

./configure \ --prefix="$HOME/ffmpeg_asan_build" \ --pkg-config-flags="" \ --extra-cflags="-I$HOME/ffmpeg_asan_build/include -O0 -fno-omit-frame-pointer -g -fsanitize=address -fsanitize=undefined" \ --extra-ldflags="-L$HOME/ffmpeg_asan_build/lib -fsanitize=address -fsanitize=undefined" \ --extra-libs="-lpthread -lm -ldl" \ --bindir="$HOME/asan_bin" \ --enable-gpl \ --enable-libass \ --enable-libfreetype \ --enable-libmp3lame \ --enable-libopus \ --enable-libvorbis \ --enable-libx264 \ --enable-libx265 \ --enable-nonfree \ --enable-debug \ --disable-shared \ --disable-asm

​

I also compiled a separate binary for debugging with normal GCC without AFL++ modifications, and it crashed as expected. I've tried everything to fix these issues, but nothing has worked. If someone can provide assistance or guidance, it would be greatly appreciated.

https://preview.redd.it/jlh424o1fylc1.png?width=1604&format=png&auto=webp&s=b3c11436fff310a8628606d7255edc27f983559a

I'm very new to fuzzing but I would like to know how Libfuzzer,AFL++ and Google Fuzztest differ? Is google fuzztest built on top of Libfuzzer?

​

I am trying to develop a deep learning library from scratch (in C,C++,,mostly c++) and I would like to know which of these tools should I use for fuzz testing- Libfuzzer or Google Fuzztest? I'm currently using clang compiler and building with bazel.

Whats you opinion on fuzzing Windows network services?

I mean Microsoft is definitely fuzzing their products at high scale, so is it even worth to try?

I imagine I need to host it myself and then aim a fuzzer at it. How can I do this? A good YT video would be appreciated.

I encountered issues during previous fuzzing attempts, ultimately stemming from not accurately confirming the module names. In such situations, I experienced two similar cases with differing methods of confirmation: 1: Incorrect names were displayed in Windbg, but the accurate module name could be confirmed through drrun. 2: Incorrect names were output by drrun, but the correct module name could be confirmed through drrun.

Of course, the two cases were not exactly the same. In the first case, the module name was related to the DLL file, while in the second case, it pertained to the module name of an executable (EXE) file. However, I'm curious about the reasons behind the discrepancies in these two cases.

When running winafl, there is an optional option called "-fuzz_iterations." While not mandatory, it seems to be related to specifying the number of iterations for fuzzing tests. However, I understand that it's not as straightforward as simply setting the number of fuzzing test iterations. Could someone clarify what exactly this option specifies in terms of the number of iterations?

Recently, I've developed an interest in WinAFL and attempted to fuzz Monkey's Audio.exe, one of the audio codecs, using this tool. However, I've encountered a problem. In the command below, "MAC.exe" represents the CLI version of Monkey's Audio.exe.

afl-fuzz.exe -i in -o out -t 2000 -D C:\winafl\DynamoRIO-Windows-10.0.19657\bin32 -- -coverage_module MAC.exe -target_module MAC.exe -target_offset 0x001750 -- MAC.exe @@ result\5sec.ape -c1000

While attempting fuzzing with the above command, I encountered the following output:

[-] PROGRAM ABORT : No instrumentation detectedLocation : perform_dry_run(), C:\winafl\winafl\afl-fuzz.c:3329

This was accompanied by an "unrecognized command received over pipe" assert warning. I have carefully reviewed the offset section and found no apparent errors. The loaded modules, as indicated by the output, seem to be normal.

The output provided below is from running "drrun" with the "-debug" option. Surprisingly, even when the mentioned command is executed, the last part of the command, which is:

MAC.exe <seed file> result\5sec.ape -c1000

produces the expected output file "5sec.ape."

​

It seems like WinAFL is not performing fuzzing correctly. Can you help identify what might be the issue?

Ok so I used to use AFL a couple years back with no issue, however I don't have my notes from before and don't remember getting the issue im getting now. Everytime I try to fuzz a binary (precompiled) I am getting a forkserver handshake error. I have tried adjusting the timeout etc. This is for both trying to fuzz a WPE and an ELF binary. Anyone got any ideas on troubleshooting this?

Who can help please about "ffuf - w wordlist.txt - u http://192.168.5.6/FUZZ - recursion" mode i found the first path butci can't find the others onenin yhe same wordlist only one job done not others even i put "- recursion-depth 3" only jobs 1 done.

Paper: https://arxiv.org/pdf/2309.03496

Code: https://github.com/FuzzAnything/hopper