0

Thinking of how a fuzzer brute-forces a lot of input to a program to discover vulnerabilities, it seems natural that one would then consider the concept of writing a program that analyzes the target program's structure more fundamentally / intelligently to find similar vulnerabilities more efficiently.

I figure I'm almost certainly not the first one to think of it, so I'm guessing it exists and there's a term for it.

Is there? If so, what, and if not, why?

5
  • 1
    Sounds like you are after some combination of fuzzer and taint analysis. Here's one example of a paper (regarding "data flow sensitive fuzzing") that might address some aspects of your question: usenix.org/system/files/sec20spring_gan_prepub.pdf
    – hft
    Aug 9, 2021 at 17:27
  • @hft tyty. Looks like a good read.
    – J.Todd
    Aug 9, 2021 at 17:53
  • 1
    That would be called a better fuzzer.
    – user253751
    Aug 10, 2021 at 9:10
  • @user253751 Well really I was thinking more of boundary calculation. If fuzzing is simulating a bunch of particles thrown at the edges of a polygon to find any holes or concave dips, ____ is running an algorithm on the position and size of the edges to calculate the same results, minus the brute force. Perhaps that's not possible - finding memory boundaries and calculating collisions - but I don't know whether it is or not, so I asked.
    – J.Todd
    Aug 10, 2021 at 20:54
  • That makes me think of formal verification, which is not a fuzzing tool, but a very tedious and difficult manual process.
    – user253751
    Aug 11, 2021 at 8:19

1 Answer 1

1

The usual term I've heard for such software is a "smart fuzzer", "whitebox fuzzer", or (specifically for fuzzers designed around a particular data format, e.g. XML), "data-aware fuzzer". For example, see Microsoft's SAGE fuzzer (more detail on SAGE), which was termed a "whitebox fuzzer" and relies on program flow analysis of the binary plus a constraint solver that attempts to mutate the input to hit every code path possible, including things that would be out-of-bounds or similar errors to the original programmer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .