fhenneke
Joined 9 years ago
Karma
40
Submissions
25
Member since
Mar 8
Recent submissions
Comment · 5 years ago
While I agree with most of what you are saying (let's hope that 2021 will finally be "the year of memory-safe languages"), remote code execution issues also affect Java. https://securitylab.github.com/research/securing-the-fight-a... is just one of the latest prominent examples.
Comment · 5 years ago
With minor changes to the default exclude list for coverage instrumentation, you can use Jazzer to fuzz the Java standard library (at least the parts that are implemented in Java).
Comment · 5 years ago
That depends on the language you want to fuzz. A good general introduction and hands-on "course" for C/C++ is https://github.com/Dor1s/libfuzzer-workshop. If you prefer Java and just want to get a feeling for how concrete fuzz targets can look like, take a look at the Jazzer examples at https://github.com/CodeIntelligenceTesting/jazzer/tree/main/....
Comment · 5 years ago
One of the authors of Jazzer here. Feel free to ask any questions regarding Jazzer (https://github.com/CodeIntelligenceTesting/jazzer) or how to integrate Java/JVM projects into OSS-Fuzz.
Comment · 5 years ago
The FuzzedDataProvider (docs at https://codeintelligencetesting.github.io/jazzer-api/com/cod...) offers many of the functions you would need to write such a generator. If there is something missing that could be generally useful, we can always add it.
Comment · 5 years ago
Thanks for the link, I wasn't aware of this new feature!
Our coverage instrumentation does not rely on JNI calls, only the libFuzzer callbacks do, so the overhead shouldn't be too substantial. It's certainly not a proper benchmark, but one core on my laptop can fuzz the more non-trivial examples at around 10,000 exec/s. We are also working on some further performance improvements.
Comment · 5 years ago
If you want to fuzz a Java web app, our commercial platform CI Fuzz (of which Jazzer is one part) has built-in detectors for the typical vulnerabilities such as SQL injections: https://blog.code-intelligence.com/sql-fuzzing
Comment · 5 years ago
Good catch, thanks ;-) I will update the post.
Comment · 5 years ago
By default, uncaught exceptions and memory issues in JNI libraries are reported as "crashes".
Additionally, Jazzer provides a hooking framework that can be used to implement domain-specific sanitizers for logic bugs. See https://blog.code-intelligence.com/engineering-jazzer#user-c... for an example. Part of the reason for open-sourcing Jazzer has been to get the discussion started on what kind of "sanitizers" are needed to unlock the full potential of Java fuzzing.
Comment · 5 years ago
I'm one of the engineers behind Jazzer and happy to answer any questions about it.
We also have a blogpost that talks about the most interesting technical aspects of Jazzer: https://blog.code-intelligence.com/engineering-jazzer