Automated Whitebox Fuzz Testing

By Patrice Godefroid, Michael Y. Levin, David A. Molnar. Network and Distributed System Security Symposium, 2008

1,349 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/5d8ee8265f8222a5700651bbd8da4a0a8fef469c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Symbolic execution for software testing in practice: preliminary assessment (2011, methodology): “Recent extensions have tried to address this challenge by using heuristics to guide path exploration [13,29], interleaving symbolic execution with random testing [40], caching function summaries for later use by higher-level functions [26] or eliminating redundant paths by analyzing the values read ”
Coverage-directed differential testing of JVM implementations (2016, background): “Godefroid, Levin, and Mol-nar have presented another idea of whitebox fuzz testing [16].”
Unleashing Mayhem on Binary Code (2012, background): “In addition, most symbolic execution engines do not reason about symbolic memory, thus do not meet principle #4.”
KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs (2008, unknown): “Like KLEE , other symbolic execution systems implement their own optimizations before sending the queries to the underlying constraint solver, such as the simple syntactic transformations presented in [36], and the constraint subsumption optimization discussed in [27].”
Steelix: program-state based binary fuzzing (2017, unknown): “SAGE [31, 32] leverages symbolic analysis on execution traces and relies on constraint solving to generate tests.”
Automated concolic testing of smartphone apps (2012, background): “Our system also builds upon recent advances in concolic testing such as function summarization [12], generational search [16], and Satisfiability Modulo Theories (SMT) solving [8].”
Directed Greybox Fuzzing (2017, background): “Coverage-basedwhitebox fuzzers [7, 12, 13] use symbolicexecution to increase coverage.”
AppIntent: analyzing sensitive data transmission in android for privacy leakage detection (2013, background): “generation [14, 17, 27, 28, 34, 39], fuzz testing [35], and security ﬂaws detection [13, 15, 20, 26, 31, 42].”
Learn&Fuzz: Machine learning for input fuzzing (2017, methodology): “Seed minimization is a standard first step applied before file fuzzing [30], [11].”
AVATAR: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares (2014, background): “, packed or obfuscated code) and to perform a wide range of more sophisticated examinations [24] - including taint propagation [33], [55], symbolic and concolic execution [10], [15], [22], unpacking [34], malware sandboxing [1], [5], and whitebox fuzzing [28], [29].”
QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing (2018, methodology): “To mitigate this problem, SAGE [4, 44] proposes generational search to maximize the number of test cases in one execution and applies unrelated constraint solving [45].”
Skyfire: Data-Driven Seed Generation for Fuzzing (2017, methodology): “SAGE [11, 12] and the approach in [10] leverage symbolic execution to perform fuzzing.”
NAUTILUS: Fishing for Deep Bugs with Grammars (2019, methodology): “More advanced techniques are either taint-based [24], [27], [29], [43], [50], symbolic [26], or concolic [31], [32], [46] (a portmanteau of concrete and symbolic).”
Heuristics for Scalable Dynamic Test Generation (2008, methodology): “Further, dynamic test generation tools EXE [3] and SAGE [13] use similar strategies and code coverage heuristics.”
Baggy Bounds Checking: An Efficient and Backwards-Compatible Defense against Out-of-Bounds Errors (2009, methodology): “USENIX Association 18th USENIX Security Symposium 73 such as EXE and SAGE [8, 14], as a post-processing step on constraints created by our tool.”
TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection (2010, methodology): “For example, with the help of fuzzing tools, “Month of Browser Bugs” [10] and “Month of Kernel Bugs” [11] published bugs in various browsers and kernels on a daily basis for the month of July and November in 2006.”
Superion: Grammar-Aware Greybox Fuzzing (2018, unknown): “SAGE [26, 27], Babi´c et al. [6], Pham et al. [53] and Badger [48] leverage symbolic execution to facilitate fuzzing.”
Symbolic execution for software testing: three decades later (2013, methodology): “For example, Microsoft has developed SAGE, a dynamic symbolic execution tool for x86 binaries that has discovered several critical bugs in large Windows applications such as image processors and ﬁle decoders [21], and also PEX [38], a tool for .”