Experiment with libFuzzer and fuzzing in general
Open
Nobody has claimed this yet.
testing
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
I would like to fuzz the various hash extraction programs we have, to improve their robustness.
https://github.com/kholia/JohnTheRipper/tree/libFuzzer is a start. It has already found some crashes in keepass2john.c 👍
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the libFuzzer branch linked in the issue and review the crashes it found in keepass2john.c. Survey the hash extraction programs mentioned in the issue and determine which fuzzing coverage is still missing. Done means the targeted programs have fuzzing support and improved robustness, but the issue does not define a narrower completion criterion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security, testing-qa
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100