My question is rather generic. People are likely to downvote the question and admins will be tempted to close it at
off-topic etc. But, I couldn't help myself asking the question to seek some fruitful answers.
Numerous software bugs/vulnerabilities/exploits are being found everyday. Security forums and mailing lists are getting overwhelmed by receiving the amount of posts researchers/users/engineers are posting everyday. CVE/NVD databases are getting filled up at lightening speed. What has surprised me for quite a while is how people are finding so many bugs in a short span of time, unless a large number of software are systematically explored/hunted for loopholes. For example, this guy has reported six bugs in this year so far.
As far as the bug-hunting techniques are concerned, what I can think of are the following:
- Black-box fuzzing (for both open and closed source products (COTS))
- White-box fuzzing (for open source products only)
- Symbolic execution guided search (not so scalable, to my knowledge)
- Reverse engineering (hectic, quite a lot of man hours involved)
- Hitting a bug by-chance (probably applicable to the cases reported by most of the end users)
- Code walkthrough (needs access to the source code, suited for internal auditing or open source products)
- Static analysis tools that helps in finding bugs of known patterns
- Dynamic analysis tools (not much familiar with this)
Still I wonder if any combination of all of the above can lead to discovery of so many bugs at such a rapid rate. Is/Are there any major techniques(s) I am missing?