Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It depends really a lot on what your target looks like, both in terms of what interfaces it has and what programming language you're using.

A very simple case that's a good start is if you have C or C++ code and already have some form of command line tool that parses an input file and does something with it noninteractively. Then you can easily use afl, ideally coupled with address sanitizer (a compiler feature to catch memory safety bugs).

If you want to up your game, don't target applications, target functoins. The go-to tool is libfuzzer.

If you leave C/C++ then the answer depends really on what programming language and what you even want to test for. (Looking for memory corruption bugs is just the most common thing to do with fuzzing, so if you don't have those, you need something else to look for.)



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: