Grammar-based whitebox fuzzing

By Patrice Godefroid, Adam Kiezun, Michael Y. Levin. ACM-SIGPLAN Symposium on Programming Language Design and Implementation, 2008

625 citations recorded by the source corpus.

Subfields: Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/a6d3dd9b1f5302658913751507c772e112b0b37e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Software

In Signal Processing

Citations in the corpus

Fuzzing: A Survey for Roadmap (2022, background): “Whitebox fuzzing usually utilizes concolic execution (i.e., dynamic symbolic execution) to analyze target programs [71, 81, 150, 177, 204].”
Superion: Grammar-Aware Greybox Fuzzing (2018, positive): “Godefroid et al. [25] apply symbolic execution to generate grammar-based constraints, and use grammar-based constraint solver to generate test inputs.”
HAMPI: a solver for string constraints (2009, methodology): “Automatic test-case generation tools that use combined concrete and symbolic execution, also known as concolic execution [5,6,17, 18, 23, 34] have trouble creating test cases that achieve high coverage for programs that expect structured inputs, such as those that require input strings from a contex”
TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection (2010, background): “They successfully detected serious bugs in GNU coreutils [27], large shipped Windows applications [43], [41], and Linux file systems [28].”
Steelix: program-state based binary fuzzing (2017, background): “Note that a number of advances have also been made to improve the effectiveness and efficiency of generation-based fuzzing [10, 14, 26, 30, 35, 39, 42, 45, 46, 50].”
FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage (2017, methodology): “It has been used successfully by major software companies such as Microsoft [16] and Google [5, 13, 33] for security testing and quality assurance.”
Learning to Fuzz: Application-Independent Fuzz Testing with Probabilistic, Generative Models of Input Data (2016, methodology): “Fuzz Testing Fuzz testing has been used to test UNIX utilities [34], compilers [49], runtime engines [18, 23], refactoring engines [16], other kinds of applications [20], and to find and exploit security vulnerabilities [28, 39, 45].”
Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, neutral): “Because of its simplicity and practical effectiveness, fuzzing has become one of the main approaches for software testing [21, 30, 38, 68].”
Learn&Fuzz: Machine learning for input fuzzing (2017, background): “Grammar-based fuzzing can also be combined with whitebox fuzzing [20], [10].”
Prospex: Protocol Specification Extraction (2009, methodology): “Conversely, the protocol specifications generated by Prospex could be used to enhance white-box fuzzing of complex network applications by leveraging a grammar-based constraint solver [62].”
Heuristics for Scalable Dynamic Test Generation (2008, positive): “Grammar-based techniques have recently been proposed [20, 11] for generating complex inputs for software systems.”
REDQUEEN: Fuzzing with Input-to-State Correspondence (2019, neutral): “One common approach to handle state explosion is to use concolic execution [21]– [23], [26], [33], [38], [40].”
Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations (2014, background): “…accidentally did not check whether the key used to sign the server’s key exchange messages matches the public key in the certificate presented by the server, leaving this implementation vulnerable to server impersonation [49] (this vulnerability is not caused by incorrect certificate validation).”
CollAFL: Path Sensitive Fuzzing (2018, background): “Grammar-based fuzzers [15, 17] generate testcases based on known input grammar.”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, methodology): “While DSE is an active research area [93], [91], [41], [179], [116], works in DSE generally do not claim to be about white-box fuzzing and so we did not include many such”
Automatic Reverse Engineering of Data Structures from Binary Execution (2010, background): “There is a large body of research in vulnerability discovery such as Archer [41], EXE [10], Bouncer [15], BitScope [7], DART [22], and SAGE [23, 21].”