zzuf - multi-purpose fuzzer
zzuf is a transparent application input fuzzer. Its purpose is to find bugs in applications by corrupting their user-contributed data (which more than often comes from untrusted sources on the Internet). It works by intercepting file and network operations and changing random bits in the program’s input. zzuf’s behaviour is deterministic, making it easier to reproduce bugs. Its main areas of use are:
- quality assurance: use zzuf to test existing software, or integrate it into your own software’s testsuite
- security: very often, segmentation faults or memory corruption issues mean a potential security hole, zzuf helps exposing some of them
- code coverage analysis: use zzuf to maximise code coverage
zzuf’s primary target is media players, image viewers and web browsers, because the data they process is inherently insecure, but it was also successfully used to find bugs in system utilities such as objdump.
zzuf is not rocket science: the idea of fuzzing input data is barely new, but zzuf’s main purpose is to make things easier and automated. You can see an old, impressive list of bugs found with zzuf.
Support
Fully supported: Linux (glibc), FreeBSD, OpenBSD, Mac OS X and OpenSolaris
Almost working: NetBSD
Not ready: Windows
Downloads
Downloads happen on Github: https://github.com/samhocevar/zzuf/releases
Documentation
The zzuf
tutorial is a hands-on guide to the most important zzuf
features. It starts with the working principles but goes on with very advanced uses of the tool.
Warning: this tutorial requires zzuf
version 0.11 or later.
- Basic zzuf usage
1.1. Launchingzzuf
1.2. Invoking different programs
1.3. The fuzzing ratio
1.4. The random seed
1.5. Creating fuzzed files - zzuf as a batch testing tool
2.1. Debug mode
2.2. Include and exclude patterns
2.3. Seed ranges
2.4. Ratio ranges - WORK IN PROGRESS
Presentations
Sam gave a few talks about zzuf. The slides contain information you may find useful:
- FOSDEM 2007 (Sam actually missed that talk) - PDF or OpenOffice
- Hacker Space Festival 2008 - PDF or OpenOffice
Internals documentation
zzuf is full of black magic and can be pretty difficult to hack with. The internals documentation tries to shed light on the global architecture and some specific tricks.
Development
Development happens on GitHub:
If you want to discuss zzuf or report bugs, you can use the GitHub issue tracker, or write to sam@hocevar.net, or even join #libcaca on irc.freenode.net.
They use zzuf
- Goatse Security uses zzuf to find issues in various third-party applications.
- Security researchers at Adobe use zzuf to stress test their applications and libraries.
- The CERT Basic Fuzzing Framework (BFF) is based on zzuf.
Attachments (10)
- zzuf-20070225.pdf (606.8 KB) - added by 16 years ago.
- zzuf-20070225.odp (1.1 MB) - added by 16 years ago.
- zzuf-0.10.tar.gz (415.9 KB) - added by 16 years ago.
- zzuf-0.11.tar.gz (430.0 KB) - added by 16 years ago.
- zzuf-0.12.tar.gz (435.6 KB) - added by 16 years ago.
- zzuf-20080621.odp (419.5 KB) - added by 16 years ago.
- zzuf-20080621.pdf (609.8 KB) - added by 16 years ago.
- zzuf-0.13.tar.gz (450.7 KB) - added by 15 years ago.
- zzuf-osx-0.13.tar.gz (143.1 KB) - added by 15 years ago.
-
zzuf-osx-0.13.r4394.tar.gz (143.4 KB) - added by 14 years ago.
zzuf snapshot