fuzz testing

Fuzzers can reveal vulnerabilities in the software by generating test input data and feeding inputs to software under test. The approach of grammar-based fuzzers is to search in the domain of test data which can be generated by grammar in order to find an attack vector with the ability to exploit the vulnerability. The challenge of fuzzers is a very large or infinite search domain and finding the answer in this domain is a hard problem. Grammatical Evolution(GE) is one of the evolutionary algorithms that can utilize grammar to solve the search problem. In this research, a new approach for generation of fuzz test input data by using grammatical evolution is introduced to exploit the cross-site scripting vulnerabilities. For this purpose, a grammar for generating of XSS attack vectors is presented and a fitness calculation function is proposed to guide the GE in search for exploitation. This method has realized the automatic exploitation of vulnerability with black-box approach. In the results of this research, 19% improvement achieved in the number of vulnerabilities discovered compared to the white-box method of NAVEX and black-box ZAP tool, and without any false positives.

Fuzzing is a dynamic software testing technique. In this technique with repeated generation and injection of malformed test data to the software under test (SUT), we are looking for the possible errors and vulnerabilities. Files are significant inputs to most real-world applications. Many of test data which are generated for fuzzing such programs are rejected by the parser because they are not in the acceptable format and this results in a low code coverage in the process of fuzz testing. Using the grammatical structure of input files to generate test data leads to increase code coverage. However, often, the grammar extraction is performed manually, which is a time consuming, costly and error-prone task. In this paper, a new method, based on deep neural language models (NLMs), is proposed for automatically learning the file structure and then generating and fuzzing test data. Our experiments demonstrate that the data produced by this method leads to an increase in the code coverage compared to previous test data generation methods. For MuPDF software, which accepts the PDF complex file format as an input, we have more than 1.30 to 12 percent improvement in code coverage than both the intelligence and random methods.

In this paper, a gray box fuzzer is presented to detect vulnerabilities in executable binary code. The literature surveys show that fuzz testing has three major problems. At first, the input space provided by the fuzzers to coverage execution paths in a binary program, can be very large. Secondly, most fuzzers can not support sufficient coverage of execution paths because of large input space. Finally, a large number of possible vulnerabilities can not reveal within an unseen execution path because of this unsufficient coverage. The proposed method, resolves the problem of large input space, in an evolutionary process, by conducting the test data generation towards suspicious paths in which one or more vulnerability patterns are observed. In the presented method, when a vulnerablility pattern is observed in an execution path by a test data, the next test data is generated revealing the vulnerablity. As a result, the number of detected vulnerabilities can increase. Our evaluations show better performance of presented method compared to other fuzz testing methods.