trailofbits / trailofbits/testing-handbook

Grammar fuzzing knowledge

Open
#116 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
HTML
Stars
135
Forks
22
PR merge metrics
No merged PRs in 30d

Description

Currently we do not have any grammar fuzzing chapters. It's a big part of fuzzing and has be proven to find many bugs int he past. I can help redacting this chapter if anyone is down.

We should especially mention the followings tools:

Grimoir - Coverage-guided fuzzing that learns structure while fuzzing (no grammar required)
Nautilus - Coverage-guided fuzzing with a user-provided grammar (classic “grammar + coverage feedback”)
Gramatron - Coverage-guided grammar-aware fuzzing, but instead of directly mutating parse trees it uses grammar automatons
Autarkie - Instant grammar fuzzing in Rust: the grammar is defined in Rust code and a fuzzer is (mostly) generated for you using procedural macros
Gramarimator - A grammar-based generator/fuzzer built around ANTLR v4 grammars
Fandango - A specification-driven fuzzer/generator where the spec is grammar + constraints.

Nautilus and Fandango are IMO the most important of the list.

Most of them can be plugged into LibAFL.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the handbook's existing fuzzing chapters and determine where a grammar fuzzing chapter belongs; no file or entry point is named in the issue. Cover grammar fuzzing with particular attention to Nautilus and Fandango, include the other listed tools, and explain how they relate to LibAFL. Done means the chapter is integrated into the handbook and accurately describes the tools.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
documentation, security, testing-qa
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.