IFuzzer: An Evolutionary Interpreter Fuzzer Using Genetic Programming

Veggalam, Spandan; Rawat, Sanjay; Haller, Istvan; Bos, Herbert

doi:10.1007/978-3-319-45744-4_29

Cited by 79 publications

(56 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…How does CodeAlchemist perform compared to existing JS fuzzers in terms of their bug finding ability? To answer this question, we compared CodeAlchemist against jsfunfuzz [27], which is the state-of-the-art fuzzers maintained by Mozilla, and IFuzzer [33], which is a variant of LangFuzz [17]. We first evaluated these three fuzzers to compare how many known CVEs and bugs they can find in an old version of ChakraCore.…”

Section: Comparison Against State-of-the-art Js Engine Fuzzersmentioning

confidence: 99%

“…GramFuzz [13] and BlendFuzz [37] use the same intuition as LangFuzz, but they focus on other languages such as HTML, CSS, as well as JS. IFuzzer [33] improves upon LangFuzz by employing genetic programming to generate unseen JS test cases. TreeFuzz [24] and Skyfire [35] construct probabilistic language models from a given set of seeds in order to generate valid JS code snippets.…”

Section: A Fuzzingmentioning

confidence: 99%

See 1 more Smart Citation

CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines

Han¹,

Oh²,

Kil³

2019

Proceedings 2019 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

JavaScript engines are an attractive target for attackers due to their popularity and flexibility in building exploits. Current state-of-the-art fuzzers for finding JavaScript engine vulnerabilities focus mainly on generating syntactically correct test cases based on either a predefined context-free grammar or a trained probabilistic language model. Unfortunately, syntactically correct JavaScript sentences are often semantically invalid at runtime. Furthermore, statically analyzing the semantics of JavaScript code is challenging due to its dynamic nature: JavaScript code is generated at runtime, and JavaScript expressions are dynamically-typed. To address this challenge, we propose a novel test case generation algorithm that we call semantics-aware assembly, and implement it in a fuzz testing tool termed CodeAlchemist. Our tool can generate arbitrary JavaScript code snippets that are both semantically and syntactically correct, and it effectively yields test cases that can crash JavaScript engines. We found numerous vulnerabilities of the latest JavaScript engines with CodeAlchemist and reported them to the vendors.

show abstract

Section: Comparison Against State-of-the-art Js Engine Fuzzersmentioning

confidence: 99%

Section: A Fuzzingmentioning

confidence: 99%

CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines

Han¹,

Oh²,

Kil³

2019

Proceedings 2019 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Many fuzzers [10], [23], [24], [25] generate inputs based on context-free grammar. Csmith [10] is a C-compiler test tool which can generate random C programs conforming to the C99 standard.…”

Section: Generation-based Fuzzingmentioning

confidence: 99%

“…Sirer and Bershad developed lava [23] to generate effective test suites for JVM. IFuzzer [24] takes the context-free grammar of a language as the input to generate parse trees and to extract code fragments from a given test-suite. Then it generates new code fragments by performing genetic operations on the parse tree.…”

Section: Generation-based Fuzzingmentioning

confidence: 99%

DeepFuzzer: Accelerated Deep Greybox Fuzzing

Liang

Jiang

Wang

et al. 2020

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Fuzzing is one of the most effective vulnerability detection techniques, widely used in practice. However, the performance of fuzzers may be limited by their inability to pass complicated checks, inappropriate mutation frequency, arbitrary mutation strategy, or the variability of the environment. In this paper, we present DeepFuzzer, an enhanced greybox fuzzer with qualified seed generation, balanced seed selection, and hybrid seed mutation. First, we use symbolic execution in a lightweight approach to generate qualified initial seeds which then guide the fuzzer through complex checks. Second, we apply a statistical seed selection algorithm to balance the mutation frequency between different seeds. Further, we develop a hybrid mutation strategy. The random and restricted mutation strategies are combined to maintain a dynamic balance between global exploration and deep search. We evaluate DeepFuzzer on the widely used benchmark Google fuzzer-test-suite which consists of real-world programs. Compared with AFL, AFLFast, FairFuzz, QSYM, and MOPT in the 24-hour experiment, DeepFuzzer discovers 30%, 240%, 102%, 147%, and 257% more unique crashes, executes 40%, 36%, 36%, 98%, and 15% more paths, and covers 37%, 34%, 34%, 101%, and 11% more branches, respectively. Furthermore, we present the practice of fuzzing a message middleware from Huawei with DeepFuzzer, and 9 new vulnerabilities are reported.

show abstract

“…A fuzzer can be classified as generation-based (e.g., [33,62,64,69]) or mutation-based (e.g., [9,42,54,58]), depending on whether test inputs are generated by the knowledge of the input format or grammar or by modifying well-formed test inputs. A fuzzer can also be classified as whitebox (e.g., [26,52]), greybox (e.g., [9,42]) or blackbox (e.g., [45,66]), depending on the degree of leveraging a target program's internal structure, which reflects the tradeoffs between effectiveness and efficiency.…”

Section: Introductionmentioning

confidence: 99%

Superion: Grammar-Aware Greybox Fuzzing

Wang

Chen

Wei

et al. 2019

2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE)

185

View full text Add to dashboard Cite

In recent years, coverage-based greybox fuzzing has proven itself to be one of the most effective techniques for finding security bugs in practice. Particularly, American Fuzzy Lop (AFL for short) is deemed to be a great success in fuzzing relatively simple test inputs. Unfortunately, when it meets structured test inputs such as XML and JavaScript, those grammar-blind trimming and mutation strategies in AFL hinder the effectiveness and efficiency.To this end, we propose a grammar-aware coverage-based greybox fuzzing approach to fuzz programs that process structured inputs. Given the grammar (which is often publicly available) of test inputs, we introduce a grammar-aware trimming strategy to trim test inputs at the tree level using the abstract syntax trees (ASTs) of parsed test inputs. Further, we introduce two grammar-aware mutation strategies (i.e., enhanced dictionary-based mutation and tree-based mutation). Specifically, tree-based mutation works via replacing subtrees using the ASTs of parsed test inputs. Equipped with grammar-awareness, our approach can carry the fuzzing exploration into width and depth.We implemented our approach as an extension to AFL, named Superion; and evaluated the effectiveness of Superion on real-life large-scale programs (a XML engine libplist and three JavaScript engines WebKit, Jerryscript and ChakraCore). Our results have demonstrated that Superion can improve the code coverage (i.e., 16.7% and 8.8% in line and function coverage) and bug-finding capability (i.e., 31 new bugs, among which we discovered 21 new vulnerabilities with 16 CVEs assigned and 3.2K USD bug bounty rewards received) over AFL and jsfunfuzz. We also demonstrated the effectiveness of our grammar-aware trimming and mutation.

show abstract

IFuzzer: An Evolutionary Interpreter Fuzzer Using Genetic Programming

Cited by 79 publications

References 27 publications

CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines

CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines

DeepFuzzer: Accelerated Deep Greybox Fuzzing

Superion: Grammar-Aware Greybox Fuzzing

Contact Info

Product

Resources

About