| /external/AFLplusplus/docs/ |
| D | README.md | 11 ## Fuzzing targets with the source code available
13 You can find a quickstart for fuzzing targets with the source code available in
14 the [README.md of the repository](../README.md#quick-start-fuzzing-with-afl).
16 For in-depth information on the steps of the fuzzing process, see
20 
11 …sec.com/index.php/2023/06/19/the-art-of-fuzzing/](https://bushido-sec.com/index.php/2023/06/19/the…
12 …ps://securitylab.github.com/research/fuzzing-challenges-solutions-1](https://securitylab.github.co…
13 * [https://securitylab.github.com/research/fuzzing-software-2](https://securitylab.github.com/resea…
14 … [https://securitylab.github.com/research/fuzzing-sockets-FTP](https://securitylab.github.com/rese…
15 …https://securitylab.github.com/research/fuzzing-sockets-FreeRDP](https://securitylab.github.com/re…
16 * [https://securitylab.github.com/research/fuzzing-apache-1](https://securitylab.github.com/researc…
17 * [https://mmmds.pl/fuzzing-map-parser-part-1-teeworlds/](https://mmmds.pl/fuzzing-map-parser-part-…
30 …log.quarkslab.com/android-greybox-fuzzing-with-afl-frida-mode.html](https://blog.quarkslab.com/and…
32 If you are interested in fuzzing structured data (where you define what the
[all …]
|
| D | best_practices.md | 7 * [Fuzzing a target with source code available](#fuzzing-a-target-with-source-code-available)
8 * [Fuzzing a target with dlopen() instrumented libraries](#fuzzing-a-target-with-dlopen-instrumente…
9 * [Fuzzing a binary-only target](#fuzzing-a-binary-only-target)
10 * [Fuzzing a GUI program](#fuzzing-a-gui-program)
11 * [Fuzzing a network service](#fuzzing-a-network-service)
20 ### Fuzzing a target with source code available
25 ### Fuzzing a target with dlopen instrumented libraries
27 If a source code based fuzzing target loads instrumented libraries with
45 ### Fuzzing a binary-only target
50 ### Fuzzing a GUI program
[all …]
|
| D | fuzzing_in_depth.md | 1 # Fuzzing with AFL++
7 Fuzzing source code is a three-step process:
11 2. Prepare the fuzzing by selecting and optimizing the input corpus for the
13 3. Perform the fuzzing of the target by randomly mutating input and assessing if
19 tasks, fuzzing may put a strain on your hardware and on the OS. In particular:
23 automatically throttled. That said, especially when fuzzing on less suitable
30 that you shouldn't be fuzzing on systems where the prospect of data loss is
33 - Fuzzing involves billions of reads and writes to the filesystem. On modern
132 AFL++ which then tries to put these values into the fuzzing data at different
195 It is possible to use sanitizers when instrumenting targets for fuzzing, which
[all …]
|
| D | FAQ.md | 17 At the end of 2019, the Google fuzzing team took over maintenance of AFL,
31 in independent fuzzing benchmarks it is one of the best fuzzers available,
39 The definition of the terms whitebox, graybox, and blackbox fuzzing varies
40 from one source to another. For example, "graybox fuzzing" could mean
41 binary-only or source code fuzzing, or something completely different.
44 …[The Fuzzing Book](https://www.fuzzingbook.org/html/GreyboxFuzzer.html#AFL:-An-Effective-Greybox-F…
117 If this improves fuzzing or not is debated and no consensus has been reached
125 * Fuzzing time is lost for the time the fuzzing is stopped, minimized and
161 For more information on fuzzing network services, see
162 [best_practices.md#fuzzing-a-network-service](best_practices.md#fuzzing-a-network-service).
[all …]
|
| /external/bc/tests/fuzzing/ |
| D | bc_afl.yaml | 10 - rm -rf tests/fuzzing/bc_outputs1/
11 - rm -rf tests/fuzzing/bc_outputs2/
12 - rm -rf tests/fuzzing/dc_outputs/
29 …- afl-fuzz -i tests/fuzzing/bc_inputs1 -o tests/fuzzing/bc_outputs1 -p fast -M bc11 bin/bc -lqc -e…
46 …- afl-fuzz -i tests/fuzzing/bc_inputs1 -o tests/fuzzing/bc_outputs1 -p coe -z -S bc12 bin/bc -lqc …
63 …- afl-fuzz -i tests/fuzzing/bc_inputs1 -o tests/fuzzing/bc_outputs1 -p exploit -z -S bc13 bin/bc -…
80 …- afl-fuzz -i tests/fuzzing/bc_inputs1 -o tests/fuzzing/bc_outputs1 -p explore -z -S bc14 bin/bc -…
97 …- afl-fuzz -i tests/fuzzing/bc_inputs1 -o tests/fuzzing/bc_outputs1 -p exploit -S bc15 bin/bc -lqC…
114 …- afl-fuzz -i tests/fuzzing/bc_inputs2 -o tests/fuzzing/bc_outputs2 -p fast -M bc21 bin/bc -lqc -e…
131 …- afl-fuzz -i tests/fuzzing/bc_inputs2 -o tests/fuzzing/bc_outputs2 -p coe -z -S bc22 bin/bc -lqc …
[all …]
|
| D | bc_afl_continue.yaml | 27 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs1 -p fast -M bc11 bin/bc -lqc -e "seed = 1280937142.2098…
44 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs1 -p coe -z -S bc12 bin/bc -lqc -e "seed = 1280937142.20…
61 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs1 -p exploit -z -S bc13 bin/bc -lqc -e "seed = 128093714…
78 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs1 -p explore -z -S bc14 bin/bc -lqc -e "seed = 128093714…
95 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs1 -p exploit -S bc15 bin/bc -lqC -e "seed = 1280937142.2…
112 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs2 -p fast -M bc21 bin/bc -lqc -e "seed = 1280937142.2098…
129 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs2 -p coe -z -S bc22 bin/bc -lqc -e "seed = 1280937142.20…
146 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs2 -p exploit -z -S bc23 bin/bc -lqc -e "seed = 128093714…
163 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs2 -p explore -z -S bc24 bin/bc -lqc -e "seed = 128093714…
180 …- afl-fuzz -i- -o tests/fuzzing/bc_outputs2 -p exploit -S bc25 bin/bc -lqC -e "seed = 1280937142.2…
[all …]
|
| /external/cronet/stable/testing/libfuzzer/ |
| D | README.md | 3 [go/chrome-fuzzing](https://goto.google.com/chrome-fuzzing)
5 [Fuzzing] is a testing technique that feeds auto-generated inputs to a piece
8 [go/fuzzing-success](http://go/fuzzing-success)). You can learn more about the
9 benefits of fuzzing at [go/why-fuzz](http://go/why-fuzz).
11 This documentation covers the in-process guided fuzzing approach employed by
12 different fuzzing engines, such as [libFuzzer] or [AFL]. To learn more about
13 out-of-process fuzzers, please refer to the [Blackbox fuzzing] page in the
21 automatically discovered by buildbots, built with different fuzzing engines,
22 then uploaded to the distributed [ClusterFuzz] fuzzing system to run at scale.
44 * [Fuzzing mojo interfaces] using automatically generated libprotobuf-mutator fuzzers.
[all …]
|
| D | getting_started.md | 1 # Getting started with fuzzing in Chromium
5 It guides you how to use our latest fuzzing technology, called [FuzzTest]. This
26 our latest fuzzing technology, FuzzTest.
29 single binary blob of data - then instead use our older fuzzing technology
50 on our distributed fuzzing infrastructure [ClusterFuzz]. If it finds bugs,
138 Our fuzzing infrastructure will generate all possible strings and prove it works.
139 Obviously, that takes infinite time, so instead our fuzzing infrastructure will
144 Fuzzing should always be alongside traditional unit testing - never rely on it
183 If you want to try actually fuzzing with FuzzTest, modify your gn arguments to
196 [*] Corpus size: 1 | Edges covered: 73 | Fuzzing time: 1.60482ms | Total runs: 1.00…
[all …]
|
| /external/cronet/tot/testing/libfuzzer/ |
| D | README.md | 3 [go/chrome-fuzzing](https://goto.google.com/chrome-fuzzing)
5 [Fuzzing] is a testing technique that feeds auto-generated inputs to a piece
8 [go/fuzzing-success](http://go/fuzzing-success)). You can learn more about the
9 benefits of fuzzing at [go/why-fuzz](http://go/why-fuzz).
11 This documentation covers the in-process guided fuzzing approach employed by
12 different fuzzing engines, such as [libFuzzer] or [AFL]. To learn more about
13 out-of-process fuzzers, please refer to the [Blackbox fuzzing] page in the
21 automatically discovered by buildbots, built with different fuzzing engines,
22 then uploaded to the distributed [ClusterFuzz] fuzzing system to run at scale.
44 * [Fuzzing mojo interfaces] using automatically generated libprotobuf-mutator fuzzers.
[all …]
|
| D | getting_started.md | 1 # Getting started with fuzzing in Chromium
5 It guides you how to use our latest fuzzing technology, called [FuzzTest]. This
26 our latest fuzzing technology, FuzzTest.
29 single binary blob of data - then instead use our older fuzzing technology
50 on our distributed fuzzing infrastructure [ClusterFuzz]. If it finds bugs,
138 Our fuzzing infrastructure will generate all possible strings and prove it works.
139 Obviously, that takes infinite time, so instead our fuzzing infrastructure will
144 Fuzzing should always be alongside traditional unit testing - never rely on it
183 If you want to try actually fuzzing with FuzzTest, modify your gn arguments to
196 [*] Corpus size: 1 | Edges covered: 73 | Fuzzing time: 1.60482ms | Total runs: 1.00…
[all …]
|
| /external/angle/build/config/siso/ |
| D | clang_exception.star | 19 "./obj/chrome/test/fuzzing/htmlfuzzer_proto_gen/htmlfuzzer_sub.pb.o",
20 "./obj/chrome/test/fuzzing/jsfuzzer/jsfuzzer.o",
21 "./obj/chrome/test/fuzzing/jsfuzzer_proto_gen/jsfuzzer.pb.o",
22 "./obj/chrome/test/fuzzing/jsfuzzer_proto_gen/jsfuzzer_sub.pb.o",
23 …"./obj/chrome/test/fuzzing/renderer_fuzzing/renderer_in_process_mojolpm_fuzzer/renderer_in_process…
24 … "./obj/chrome/test/fuzzing/webidl_fuzzing/webidl_fuzzer_grammar/webidl_fuzzer_grammar.o",
25 …"./obj/chrome/test/fuzzing/webidl_fuzzing/webidl_fuzzer_grammar_proto_gen/webidl_fuzzer_grammar.pb…
26 … "./obj/chrome/test/fuzzing/webidl_fuzzing/webidl_in_process_fuzzer/webidl_in_process_fuzzer.o",
27 "./obj/chrome/test/fuzzing/webidl_fuzzing/webidlfuzzer/webidlfuzzer.o",
28 "./obj/chrome/test/fuzzing/webidl_fuzzing/webidlfuzzer/webidlfuzzer_sub0.o",
[all …]
|
| /external/flac/oss-fuzz/ |
| D | reencoder.cc | 28 #include <fuzzing/datasource/datasource.hpp>
29 #include <fuzzing/memory.hpp>
42 // fuzzing::datasource::Datasource& ds;
44 FuzzerStream(fuzzing::datasource::Datasource&) : in FuzzerStream()
48 fuzzing::memory::memory_test(buffer, bytes); in write_callback()
56 fuzzing::datasource::Datasource& ds;
59 … FuzzerDecoder(fuzzing::datasource::Datasource& dsrc, FLAC::Encoder::FuzzerStream& encoder_arg) : in FuzzerDecoder()
98 fuzzing::memory::memory_test(&(frame->header), sizeof(frame->header)); in write_callback()
99 fuzzing::memory::memory_test(&(frame->footer), sizeof(frame->footer)); in write_callback()
106 fuzzing::memory::memory_test(buffer[i], bytesPerChannel); in write_callback()
[all …]
|
| D | encoder.cc | 28 #include <fuzzing/datasource/datasource.hpp>
29 #include <fuzzing/memory.hpp>
38 // fuzzing::datasource::Datasource& ds;
40 FuzzerStream(fuzzing::datasource::Datasource&) : in FuzzerStream()
44 fuzzing::memory::memory_test(buffer, bytes); in write_callback()
59 fuzzing::datasource::Datasource ds(data, size); in LLVMFuzzerTestOneInput()
70 fuzzing::memory::memory_test(res); in LLVMFuzzerTestOneInput()
74 fuzzing::memory::memory_test(res); in LLVMFuzzerTestOneInput()
78 fuzzing::memory::memory_test(res); in LLVMFuzzerTestOneInput()
82 fuzzing::memory::memory_test(res); in LLVMFuzzerTestOneInput()
[all …]
|
| D | decoder.cc | 27 #include <fuzzing/datasource/datasource.hpp>
28 #include <fuzzing/memory.hpp>
34 template <> FLAC__MetadataType fuzzing::datasource::Base::Get<FLAC__MetadataType>(const uint64_t id… in Get()
64 fuzzing::datasource::Datasource& ds;
66 FuzzerStream(fuzzing::datasource::Datasource& dsrc) : in FuzzerStream()
96 fuzzing::memory::memory_test(&(frame->header), sizeof(frame->header)); in write_callback()
97 fuzzing::memory::memory_test(&(frame->footer), sizeof(frame->footer)); in write_callback()
104 fuzzing::memory::memory_test(buffer[i], bytesPerChannel); in write_callback()
117 fuzzing::memory::memory_test(status); in error_callback()
122 fuzzing::memory::memory_test(metadata->type); in metadata_callback()
[all …]
|
| /external/tpm2-tss/doc/ |
| D | fuzzing.md | 1 # Fuzzing chapter
6 Building fuzz tests can be enabled using the `--with-fuzzing=` option. For which
14 libFuzzer tests can be built natively or using the docker `fuzzing` target.
18 Build the fuzz tests by setting `--with-fuzzing=libfuzzer` and statically
19 linking to the fuzzing TCTI.
29 --with-fuzzing=libfuzzer \
30 --enable-tcti-fuzzing \
47 Build the fuzz targets and check that they work by building the `fuzzing` docker
51 docker build --target fuzzing -t tpm2-tss:fuzzing .
58 docker run --rm -ti tpm2-tss:fuzzing \
[all …]
|
| /external/libcxx/fuzzing/ |
| D | fuzz_test.cpp | 11 // A simple program for running regressions on the fuzzing routines.
15 // clang++ -std=c++11 fuzz_test.cpp fuzzing.cpp
32 #include "fuzzing.h"
109 {"sort", fuzzing::sort},
110 {"stable_sort", fuzzing::stable_sort},
111 {"partition", fuzzing::partition},
112 {"partition_copy", fuzzing::partition_copy},
113 {"stable_partition", fuzzing::stable_partition},
114 {"unique", fuzzing::unique},
115 {"unique_copy", fuzzing::unique_copy},
[all …]
|
| /external/pigweed/pw_fuzzer/ |
| D | concepts.rst | 9 Fuzzing is an approach to testing software with generated data. Guided fuzzing
14 #. The `fuzzing engine`_ generates a new `test input`_. The details of the
33 :alt: Coverage Guided Fuzzing
39 To learn more about how effective fuzzing can be or explore some of fuzzing's
43 .. _fuzz target: https://github.com/google/fuzzing/blob/master/docs/glossary.md#fuzz-target
44 .. _fuzzing engine: https://github.com/google/fuzzing/blob/master/docs/glossary.md#fuzzing-engine
48 .. _reproducer: https://github.com/google/fuzzing/blob/master/docs/glossary.md#reproducer
49 .. _sanitizers: https://github.com/google/fuzzing/blob/master/docs/glossary.md#sanitizer
50 .. _test input: https://github.com/google/fuzzing/blob/master/docs/glossary.md#test-input
51 .. _Why fuzz?: https://github.com/google/fuzzing/blob/master/docs/why-fuzz.md
|
| D | docs.rst | 23 not cover? `Fuzzing`_ can help!
25 However, fuzzing requires some complex interactions between compiler-added
28 fuzzing infrastructure, adding even more complexity.
37 provides convenient integration with two fuzzing `engines`_:
44 Additionally, it produces artifacts for continuous fuzzing infrastructures such
64 Fuzzing works best when code handles inputs deterministically, that is, given
65 the same input it behaves the same way. Fuzzing will be less effective with code
80 * Are built with **Clang**. The `instrumentation`_ used in fuzzing is added by
88 The first step in adding a fuzzer is to determine what fuzzing engine should you
89 use. Pigweed currently supports two fuzzing engines:
[all …]
|
| /external/jazzer-api/docs/ |
| D | junit-integration.md | 5 annotation's javadoc, our integration runs in one of two modes: fuzzing and regression. Fuzzing mod…
7 fuzzing is done. The main entrypoints for the actual integration code are found in two of the annot…
11 flow of the different methods involved in integrating with JUnit in fuzzing mode (when `JAZZER_FUZZ…
14 # Fuzzing Flow
20 The first call to this test will determine if the test should be run at all. In fuzzing mode, we on…
30 This will configure the fuzzing agent to set up code instrumentation, instantiate a `FuzzTestExecut…
36 This will be called for each argument set for the current test. In fuzzing mode, there will only be…
44 fuzzing.
51 Similar to fuzzing mode, JUnit will call these methods for each test marked with `FuzzTest`.
60 This will configure the fuzzing agent as in fuzzing mode, then gather test cases to run from the fo…
[all …]
|
| /external/tensorflow/tensorflow/security/fuzzing/ |
| D | tf_fuzzing.bzl | 3 # TensorFlow fuzzing can be done in open source too.
8 # - dictionaries/${FUZZ}.dict : fuzzing dictionary for the fuzzer
13 # across multiple fuzzers (for example fuzzing ops), we can store it in other
15 # on a case by case basis, for now the ops fuzzing harness resides under
16 # tensorflow/core/kernels/fuzzing.
19 # mutators to do structure aware fuzzing) or any other type of content that is
22 # tf_cc_fuzz_target is a cc_test modified to include fuzzing support.
25 # Fuzzing specific arguments
60 deps: An optional list of dependencies for the code you're fuzzing.
83 # tf_py_fuzz_target is a py_test modified to include fuzzing support.
[all …]
|
| /external/cronet/tot/build/config/siso/ |
| D | clang_exception.star | 18 "./obj/chrome/test/fuzzing/htmlfuzzer_proto_gen/htmlfuzzer_sub.pb.o",
19 "./obj/chrome/test/fuzzing/jsfuzzer/jsfuzzer.o",
20 "./obj/chrome/test/fuzzing/jsfuzzer_proto_gen/jsfuzzer.pb.o",
21 "./obj/chrome/test/fuzzing/jsfuzzer_proto_gen/jsfuzzer_sub.pb.o",
22 … "./obj/chrome/test/fuzzing/webidl_fuzzing/webidl_fuzzer_grammar/webidl_fuzzer_grammar.o",
23 …"./obj/chrome/test/fuzzing/webidl_fuzzing/webidl_fuzzer_grammar_proto_gen/webidl_fuzzer_grammar.pb…
24 "./obj/chrome/test/fuzzing/webidl_fuzzing/webidlfuzzer/webidlfuzzer.o",
25 "./obj/chrome/test/fuzzing/webidl_fuzzing/webidlfuzzer_proto_gen/webidlfuzzer.pb.o",
26 … "./obj/chrome/test/fuzzing/webidl_fuzzing/webidlfuzzer_proto_gen/webidlfuzzer_sub.pb.o",
|
| /external/cronet/stable/build/config/siso/ |
| D | clang_exception.star | 18 "./obj/chrome/test/fuzzing/htmlfuzzer_proto_gen/htmlfuzzer_sub.pb.o",
19 "./obj/chrome/test/fuzzing/jsfuzzer/jsfuzzer.o",
20 "./obj/chrome/test/fuzzing/jsfuzzer_proto_gen/jsfuzzer.pb.o",
21 "./obj/chrome/test/fuzzing/jsfuzzer_proto_gen/jsfuzzer_sub.pb.o",
22 … "./obj/chrome/test/fuzzing/webidl_fuzzing/webidl_fuzzer_grammar/webidl_fuzzer_grammar.o",
23 …"./obj/chrome/test/fuzzing/webidl_fuzzing/webidl_fuzzer_grammar_proto_gen/webidl_fuzzer_grammar.pb…
24 "./obj/chrome/test/fuzzing/webidl_fuzzing/webidlfuzzer/webidlfuzzer.o",
25 "./obj/chrome/test/fuzzing/webidl_fuzzing/webidlfuzzer_proto_gen/webidlfuzzer.pb.o",
26 … "./obj/chrome/test/fuzzing/webidl_fuzzing/webidlfuzzer_proto_gen/webidlfuzzer_sub.pb.o",
|
| /external/google-cloud-java/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/ |
| D | finding_addon.proto | 89 // The attack comes from fuzzing the browser's localStorage.
92 // The attack comes from fuzzing the browser's sessionStorage.
95 // The attack comes from fuzzing the window's name property.
98 // The attack comes from fuzzing the referrer property.
101 // The attack comes from fuzzing an input element.
104 // The attack comes from fuzzing the browser's cookies.
110 // The attack comes from fuzzing parameters in the url.
113 // The attack comes from fuzzing the fragment in the url.
116 // The attack comes from fuzzing the HTML comments.
119 // The attack comes from fuzzing the POST parameters.
[all …]
|
| /external/googleapis/google/cloud/websecurityscanner/v1/ |
| D | finding_addon.proto | 89 // The attack comes from fuzzing the browser's localStorage.
92 // The attack comes from fuzzing the browser's sessionStorage.
95 // The attack comes from fuzzing the window's name property.
98 // The attack comes from fuzzing the referrer property.
101 // The attack comes from fuzzing an input element.
104 // The attack comes from fuzzing the browser's cookies.
110 // The attack comes from fuzzing parameters in the url.
113 // The attack comes from fuzzing the fragment in the url.
116 // The attack comes from fuzzing the HTML comments.
119 // The attack comes from fuzzing the POST parameters.
[all …]
|