I'm happy to announce the release of a new open-source library we've been working on: Go library for structure-aware fuzzing, designed as an analogue to libprotobuf-mutator. Fuzz your gRPC APIs and integrate into SSDLC.

https://github.com/yandex-cloud/go-protobuf-mutator

#fuzzing #go #grpc #ssdlc

Discovering 12 new integer truncation #bugs (and generating PoC seeds) in LibTIFF, libpcap, nDPI, unbound, FreeImage with dynamic symbolic execution. https://arxiv.org/abs/2312.06425

My talk about #casr at OFFZONE 2023!!!
Slides:
https://offzone.moscow/upload/iblock/f15/ocurqz4vbrm0hf37197x7rufswzpycgf.pdf
Video (in Russian):
https://youtu.be/EgEeICZQD9M

#fuzzing

CASR 2.7.0 is available!
https://github.com/ispras/casr/releases/tag/v2.7.0

Simply deduplicate and create reports for #UndefinedBehaviorSanitizer warnings with Casr: casr-ubsan -i corpus -o out -- /fuzz_target @@

https://github.com/ispras/casr/blob/master/docs/usage.md#casr-ubsan

#casr #defectdojo #vulnerabilitymanagement #VulnerabilityAssesment #AppSec #DevSecOps
Image

casr-dojo: upload new and unique #crash reports found by #fuzzing to DefectDojo vulnerability management system: https://github.com/ispras/casr/blob/master/docs/usage.md#casr-dojo

#casr #defectdojo #vulnerabilitymanagement #VulnerabilityAssesment #AppSec #DevSecOps #cpp #rust #go #python

https://github.com/ispras/casr/releases/tag/v2.6.0
#casr 2.6.0, what's new:
casr-libfuzzer tool for triaging crashes found by libFuzzer based fuzzers (C/C++/go-fuzz/Atheris)
kodama crate for clustering instead of python scipy
RISCV support
#fuzzing

casr-libfuzzer: triage crashes in C/C++/Go/Python code found by libFuzzer/Atheris/go-fuzz

casr-libfuzzer -o out -- /fuzz_target

https://github.com/ispras/casr

#casr #fuzzing #libfuzzer #atheris #go #python #cpp

https://github.com/ispras/casr/releases/tag/v2.5.0
#casr 2.5.0, what's new:
#libcasr: library for crash triage, stacktrace parsing, severity estimation, and collecting crash reports.
Crash triaging for Go panics
AARCH64 support
#fuzzing

My blog post about #fuzzing #go project golang/image: https://github.com/ispras/oss-sydr-fuzz/wiki/Fuzzing-golang-image-%28Go%29-project-with--sydr-fuzz-%28go-fuzz-backend%29
0. Changing existing fuzz target to find new bugs.
1. Creating target for symbolic execution.
2. Approach for code coverage collection after fuzzing with go-fuzz libFuzzer.
3. Go panic triage with #casr.
4. Fix: https://github.com/golang/image/pull/14

New casr 2.4.0 is available!
https://github.com/ispras/casr/releases/tag/v2.4.0
casr-cli now provides a joint statistics all over reports!
casr-afl now copies crashes next to reports, produces casr reports in parallel and prints casr-cli joint statistics!
#casr #AFLplusplus

Checkout new #casr 2.3.0 release!!!
https://github.com/ispras/casr
- rust panic support in casr-san/casr-gdb
- c++ exceptions support in casr-san/casr-gdb
- casr-python for creating CASR reports from python crashes🔥​

P. S. Merry Christmas! ❄️​❄️​❄️​
#fuzzing #afl #aflplusplus #python

Finally defended my PhD "Error detection in binary code with dynamic symbolic execution" 🎉

Fuzzing ping(8) … and finding a 24 year old bug. https://www.undeadly.org/cgi?action=article;sid=20221208082054 #openbsd #ping #freebsd #fuzzing #networking #security #bugfixing

Sydr-Fuzz slides from today talk and demo video! New bugs in TensorFlow, PyTorch, Cairo, OpenJPEG, Poppler, ICU, Tarantool, Torchvision, etc.
https://vishnya.xyz/vishnyakov-isprasopen2022.pdf
https://vishnya.xyz/vishnyakov-isprasopen2022.webm

LibAFL QEMU full-system mode is a thing! Check out the example that fuzz a small ARM FreeRTOS firmware at https://github.com/AFLplusplus/LibAFL/tree/main/fuzzers/qemu_systemmode

Next step: fast memory and devices snapshots

@dmnk @aflplusplus Btw, we are open to PRs in https://github.com/ispras/oss-sydr-fuzz We can fuzz any target with sydr-fuzz in our infrastructure and give u the bugs to report!

@dmnk @aflplusplus We just open sourced Casr (a part of sydr-fuzz dynamic analysis pipeline). We don't have plans to open source other parts in near future. However, we may do so some day.

Sydr-Fuzz: Continuous Hybrid Fuzzing and Dynamic Analysis for Security Development Lifecycle https://arxiv.org/abs/2211.11595

85 new bugs in 22 open source projects. Dynamic analysis pipeline: hybrid #fuzzing with symbolic executor Sydr and libFuzzer or @aflplusplus, corpus minimization, error detection (out of bounds, integer overflow, etc.) via symbolic security predicates, collecting coverage, crash triaging (deduplication, clustering, severity estimation) with Casr: https://github.com/ispras/casr

FuzzBench: https://sydr-fuzz.github.io/fuzzbench
OSS-Sydr-Fuzz: https://github.com/ispras/oss-sydr-fuzz

At last, new casr 2.2.0 release with casr-afl!!!
Triaging crashes found by @aflplusplus as simple as it could be:
$ cargo install casr
$ casr-afl -i afl-out -o casr-out
$ casr-cli casr-out/cl1/<report_name>

https://github.com/ispras/casr

#casr #fuzzing #afl #AFLplusplus