Hacker News new | past | comments | ask | show | jobs | submit login

> Is there a way to fuzz non-string inputs?

Fuzzing usually revolves around strings because of escape characters, escape sequences. There is a much larger set of string characters than there are for the 10 or so numeric digits. Numbers don’t have the same problems that strings do, because numbers are usually interpreted only as data, whereas strings can be interpreted as data or computation.




> Fuzzing usually revolves around strings because of escape characters, escape sequences.

Not always. AFL has been used to detect issues around processing plain old binary data (eg https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8637)

I would argue that anything involving a parser of some description (either binary or text-based) is a good candidate for fuzzing.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: