#fuzzing — Public Fediverse posts

My partner need participants for a CS study.

Do you work with #fuzzing results?
Do you have opinions about the state of the art fuzzing results?
Do you have opinions about what features might improve fuzzing results?
Are you at least 18 years old and in the US?

Please fill out this 15 minute online research survey at https://forms.gle/sMZ3b59Jg9zyJfo1A

Project Title: Fuzzing Results Usability Survey
Researcher: Allison Naaktgeboren, CS, Portland State University
Researcher Contact: [email protected]

My partner need participants for a CS study.

Do you work with #fuzzing results?
Do you have opinions about the state of the art fuzzing results?
Do you have opinions about what features might improve fuzzing results?
Are you at least 18 years old and in the US?

Please fill out this 15 minute online research survey at https://forms.gle/sMZ3b59Jg9zyJfo1A

Project Title: Fuzzing Results Usability Survey
Researcher: Allison Naaktgeboren, CS, Portland State University
Researcher Contact: [email protected]

The new blog post is online - how to decide what to fuzz in a complex target: https://srlabs.de/blog/decide-what-to-fuzz
enjoy! #fuzzing #afl

The new blog post is online - how to decide what to fuzz in a complex target: https://srlabs.de/blog/decide-what-to-fuzz
enjoy! #fuzzing #afl

Мост между SAST и фаззингом: как из сработки SAST получить подтверждённую уязвимость

Инструменты статического анализа (SAST) лишь подсвечивают вероятные уязвимости, генерируя гипотезы. Динамическое тестирование (DAST) и фаззинг, напротив, выявляют реальные сбои на работающем приложении и фиксируют вектор атаки, но не указывают на конкретную строку в исходниках. Традиционно эти два подхода существуют в изоляции, образуя методологический разрыв, преодолеть который способен только AppSec-эксперт путем кропотливого ручного триажа. В этой статье мы расскажем про то, как в INFERA AI.SafeCode уменьшаем поток ложных срабатываний в целом, зачем для этого формируем единый реестр знаний о проекте, и как строим мост от SAST к автоматически подтверждаемой уязвимости.

https://habr.com/ru/companies/infera_security/articles/1061880/

#Fuzzing #безопасная_разработка #devsecops #secret_scanner #mlsecops #ai_sast #infera_aisafecode #контроль_vibe_coding #appsecинструменты #ai_dast

От сотен алертов к доказанным уязвимостям: как эволюционирует DevSecOps при объединении 7 сканеров в единый пайплайн

Классический подход к Application Security сегодня переживает кризис, ситуацию усугубляет бум AI-помощников (GitHub Copilot, Cursor, Claude). Разработка ускорилась кратно, но вместе с ней масштабировалась и генерация небезопасного кода. Разработчик теперь может сгенерировать за час то, что раньше писал день, при этом уязвимости тоже начинают появляться с такой же скоростью. Если процесс безопасности остался прежним, AppSec быстро превращается в узкое место. В этой статье мы разберем архитектуру и механику работы INFERA AI.SafeCode – платформы непрерывного анализа кода, которая отказывается от концепции «просто показать список подозрений» в пользу автоматического доказательства уязвимостей и MLSecOps-подхода. Решение объединяет SAST, SCA, Secrets, DAST, Pentest, Code Fuzzing и API Fuzzing в единый DevSecOps / MLSecOps-контур. Статья продуктовая, но мы ее публикуем на HABR не как рекламную, а как концептуальную. Хотим показать, как меняются подходы к безопасной разработке и насколько неэффективным становится «разрозненный» AppSec в эпоху ИИ и вайб-кодинга.

https://habr.com/ru/companies/infera_security/articles/1061862/

#INFERA_AISafeCode #MLSecOps #безопасная_разработка #контроль_vibe_coding #DevSecOps #AppSecинструменты #AI_SAST #AI_DAST #fuzzing #secret_scanner

WinPE as a stateless harness for Windows driver testing and fuzzing

https://bednars.me/blog/winpe-harness

#HackerNews #WinPE #WindowsDriverTesting #Fuzzing #Cybersecurity #TechBlog #DriverDevelopment

WinPE as a stateless harness for Windows driver testing and fuzzing

https://bednars.me/blog/winpe-harness

#HackerNews #WinPE #WindowsDriverTesting #Fuzzing #Cybersecurity #TechBlog #DriverDevelopment

AFL++ 5.02c release! important bugfix release for persistent fuzzing mode. New afl-health tool, C11 guidance instrumentation (helps coverage!). https://github.com/AFLplusplus/AFLplusplus/releases/tag/v5.02c #fuzzing #afl

AFL++ 5.02c release! important bugfix release for persistent fuzzing mode. New afl-health tool, C11 guidance instrumentation (helps coverage!). https://github.com/AFLplusplus/AFLplusplus/releases/tag/v5.02c #fuzzing #afl

cov-analysis v1.0 - first release! New generic fuzzing coverage gathering + analysis tool. Cool special features: stability analysis, diffing coverage, searching for seeds that reach a line, augment with reachability information and more! https://github.com/AFLplusplus/cov-analysis #fuzzing

cov-analysis v1.0 - first release! New generic fuzzing coverage gathering + analysis tool. Cool special features: stability analysis, diffing coverage, searching for seeds that reach a line, augment with reachability information and more! https://github.com/AFLplusplus/cov-analysis #fuzzing

fuzz-reachability v1.0 - first release! static analysis tool to document reachable functions for a harness in a target - to use with selective instrumentation and coverage analysis. Supported in AFL++ and clang sancov, and cov-analysis. https://github.com/AFLplusplus/fuzz-reachability #fuzzing

fuzz-reachability v1.0 - first release! static analysis tool to document reachable functions for a harness in a target - to use with selective instrumentation and coverage analysis. Supported in AFL++ and clang sancov, and cov-analysis. https://github.com/AFLplusplus/fuzz-reachability #fuzzing

@liw I mean, *of course* you should read all my papers, because why wouldn't you *g*.

More seriously: CI systems are mainly used as an environment black box here. Thy are relevant because they impose resource constraints that make #fuzzing harder than in a non-CI context (where we have already shown we can find backdoors). I don't think this work will impact CI *design* much (@plumtrie shout if you disagree). But knowing you, I do believe you'll find this work interesting nonetheless.

@liw I mean, *of course* you should read all my papers, because why wouldn't you *g*.

More seriously: CI systems are mainly used as an environment black box here. Thy are relevant because they impose resource constraints that make #fuzzing harder than in a non-CI context (where we have already shown we can find backdoors). I don't think this work will impact CI *design* much (@plumtrie shout if you disagree). But knowing you, I do believe you'll find this work interesting nonetheless.

RE: https://mastodon.social/@plumtrie/116793876956183522

In this important paper, the amazing work done by Dimitri (and coauthors) shows that it is possible to integrate #fuzzing into traditional CI setups, to successfully detect backdoors sneakily inserted into public code commits. #opensource #supplychain #security

Open access preprint upcoming.

In the meantime, you can read our previous work on « ROSA: Finding #Backdoors with Fuzzing » https://arxiv.org/abs/2505.08544 , which this new result builds upon.

RE: https://mastodon.social/@plumtrie/116793876956183522

In this important paper, the amazing work done by Dimitri (and coauthors) shows that it is possible to integrate #fuzzing into traditional CI setups, to successfully detect backdoors sneakily inserted into public code commits. #opensource #supplychain #security

Open access preprint upcoming.

In the meantime, you can read our previous work on « ROSA: Finding #Backdoors with Fuzzing » https://arxiv.org/abs/2505.08544 , which this new result builds upon.

AFL++ 5.01c release! Bug fixes, faster persistent fuzzing, better MOpt mutator, new qemu binary-only alternative, etc. https://github.com/AFLplusplus/AFLplusplus/releases #afl #fuzzing

AFL++ 5.01c release! Bug fixes, faster persistent fuzzing, better MOpt mutator, new qemu binary-only alternative, etc. https://github.com/AFLplusplus/AFLplusplus/releases #afl #fuzzing