jazzer
libfuzzer-workshop
jazzer | libfuzzer-workshop | |
---|---|---|
11 | 2 | |
906 | 1,218 | |
- | - | |
9.2 | 2.6 | |
2 months ago | 10 months ago | |
Java | C++ | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
jazzer
-
JQF Genetic Algorithm
Check out Jazzer, the code intelligence blog, and search for custom sanitizers for Java etc. https://github.com/CodeIntelligenceTesting/jazzer
-
Automated Fuzz Testing: The Power of Code Intelligence App
Input Generation: The tester uses a fuzzing tool such as CI Fuzz or Jazzer to generate random or unexpected inputs to the software application.
-
Java Fuzzing with Jazzer compared to Symflower
Fuzzing is a testing technique where random values are generated as inputs to find unexpected behavior such as crashes and security issues. Previously we looked at the new Golang release 1.18 which includes native fuzzing and our Core Technology blog series contained a post that compares symbolic execution to different other testing techniques, including fuzzing. Today, we will dive into the Java world and check out the most popular Java fuzzing solution: Jazzer.
-
jazzer.js alternatives - jazzer and cifuzz
3 projects | 12 Sep 2022
Coverage-guided fuzzer for Java
-
How to fuzz java code with jazzar?
$ git clone https://github.com/CodeIntelligenceTesting/jazzer $ cd jazzer $ ./bazelisk-linux-amd64 run //:jazzer Starting local Bazel server and connecting to it... INFO: Analyzed target //:jazzer (79 packages loaded, 1410 targets configured). INFO: Found 1 target... Target //:jazzer up-to-date: bazel-bin/jazzer INFO: Elapsed time: 43.920s, Critical Path: 7.21s INFO: 83 processes: 4 internal, 79 linux-sandbox. INFO: Build completed successfully, 83 total actions INFO: Build completed successfully, 83 total actions driver/jazzer_driver: error while loading shared libraries: libjvm.so: cannot open shared object file: No such file or directory
- How to Write Fuzz Targets with Jazzer
-
Fuzzing Java in OSS-Fuzz
One of the authors of Jazzer here. Feel free to ask any questions regarding Jazzer (https://github.com/CodeIntelligenceTesting/jazzer) or how to integrate Java/JVM projects into OSS-Fuzz.
- Jazzer: Coverage-Guided Fuzzing for JVM
- Jazzer is a coverage-guided, in-process fuzzer for the JVM platform (2021, github)
- Jazzer - a coverage-guided, in-process fuzzer for the JVM platform
libfuzzer-workshop
-
Ask HN: What are some worthy non-cryto uses of excess home compute nowadays?
Learning how to is half the fun!
There's a bunch of good tutorials out there on [dumb] fuzzing (presumably where you'll start). One starting point I'd recommend is taking a binary that accepts input from stdin and making some proof-of-concepts with AFL (https://lcamtuf.coredump.cx/afl/).
If you'd rather start from a code/library perspective (and not CLI), I'd recommend libfuzzer (https://github.com/Dor1s/libfuzzer-workshop/).
There's a lot of other fuzzers, techniques, and depth to the field, but I'd recommend inch worming through (speed up as you gain more comfort). The Fuzzing Book is good to help you understand the logic behind techniques and strategies (https://www.fuzzingbook.org/)
As for some management, there's a few decent "monitoring" systems out there; personally I just SSH in and check the fuzzer manually (I leave it running in a tmux pane), but if that's not your cup of tea I've heard good things about OneFuzz (https://github.com/microsoft/onefuzz) and LuckyCat (https://github.com/fkie-cad/LuckyCAT).
Happy to answer any specifics of the sort :)
-
Fuzzing Java in OSS-Fuzz
That depends on the language you want to fuzz. A good general introduction and hands-on "course" for C/C++ is https://github.com/Dor1s/libfuzzer-workshop. If you prefer Java and just want to get a feeling for how concrete fuzz targets can look like, take a look at the Jazzer examples at https://github.com/CodeIntelligenceTesting/jazzer/tree/main/....
What are some alternatives?
junit-quickcheck - Property-based testing, JUnit-style
PIT - State of the art mutation testing system for the JVM
American Fuzzy Lop - american fuzzy lop - a security-oriented fuzzer
jni-bind - JNI Bind is a set of advanced syntactic sugar for writing efficient correct JNI Code in C++17 (and up).
symflower - Symflower is a Java unit test generation tool for IntelliJ IDEA, Visual Studio Code, Android Studio, and CLI. Use it to write and maintain test code with ease. This repository is for providing community support.
fishnet - Distributed Stockfish analysis for lichess.org
radamsa
onefuzz - A self-hosted Fuzzing-As-A-Service platform
winafl - A fork of AFL for fuzzing Windows binaries
LuckyCAT - A distributed fuzzing management framework