In today's meeting we introduced the concept of Fuzzing, the automated dynamic analysis technique used to discover software vulnerabilities. The session covered the theory behind fuzzing, major industry statistics, and the mechanics of how modern fuzzers maximize code coverage before concluding with a hands-on workshop using industry tools.

Why Fuzzing Matters

• •Effectiveness: Fuzzing is credited with finding 4 out of 5 bugs as regressions (bugs in previously working code) and has discovered tens of thousands of critical vulnerabilities in widely-used software.
• •Code Coverage: This metric measures which lines of code are executed during a test. The primary goal of fuzzing is to maximize coverage to find "blind spots" where bugs may be hidden.
• •The Fuzzing Loop: Unlike unit tests, fuzzers discover edge cases through random mutations and evolutionary guidance. They utilize coverage feedback to prioritize inputs that reach new branches of the code.

Components of a Fuzzer

We explored the technical components of a fuzzer, including:

• •Target Function: The specific entry point receiving the fuzzed inputs.
• •Corpus: The collection of "interesting" inputs discovered during the process that triggered new code paths.
• •Seed Corpus: Initial valid inputs (like sample PDF or PNG files) used to "bootstrap" the fuzzer.
• •Mutation Techniques: Methods used to alter data, such as bit flipping, arithmetic operations, and dictionary injection.

AFL++ Demo

The meeting featured a demo of AFL++ (American Fuzzy Lop), one of the world's most popular fuzzing tools. We discussed the requirements for using AFL++, which include having the target's source code, compiling it with a special AFL++ compiler, and providing initial seed inputs.