rhetenor/awesome-awesomeness
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Updating conversion, creating readmes

Browse Source
This commit is contained in:
Jonas Zeunert
2024-04-19 23:37:46 +02:00
parent 3619ac710a
commit 08e75b0f0a
635 changed files with 30878 additions and 37344 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
terminal/fuzzing
View File

@@ -1,7 +1,7 @@
 Awesome Fuzzing !Awesome (https://awesome.re/badge.svg) (https://awesome.re)
 Awesome Fuzzing !Awesome (https://awesome.re/badge.svg) (https://awesome.re)
▐ Fuzzing (https://en.wikipedia.org/wiki/Fuzzing) or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The 
▐ program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. Typically, fuzzers are used to test programs that take structured inputs. 
▐ Fuzzing (https://en.wikipedia.org/wiki/Fuzzing) or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for 
▐ exceptions such as crashes, failing built-in code assertions, or potential memory leaks. Typically, fuzzers are used to test programs that take structured inputs. 
A curated list of references to awesome Fuzzing for security testing. Additionally there is a collection of freely available academic papers, tools and so on.
@@ -83,8 +83,7 @@
- IJON: Exploring Deep State Spaces via Fuzzing, 2020 (https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2020/02/27/IJON-Oakland20.pdf)
- Krace: Data Race Fuzzing for Kernel File Systems, 2020 (https://www.cc.gatech.edu/~mxu80/pubs/xu:krace.pdf)
- Pangolin:Incremental Hybrid Fuzzing with Polyhedral Path Abstraction, 2020 (https://qingkaishi.github.io/public_pdfs/SP2020.pdf)
- RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization, 2020 
(https://www.semanticscholar.org/paper/RetroWrite%3A-Statically-Instrumenting-COTS-Binaries-Dinesh-Burow/845cafb153b0e4b9943c6d9b6a7e42c14845a0d6)
- RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization, 2020 (https://www.semanticscholar.org/paper/RetroWrite%3A-Statically-Instrumenting-COTS-Binaries-Dinesh-Burow/845cafb153b0e4b9943c6d9b6a7e42c14845a0d6)
- Full-speed Fuzzing: Reducing Fuzzing Overhead through Coverage-guided Tracing, 2019 (https://www.computer.org/csdl/proceedings-article/sp/2019/666000b122/19skgbGVFEQ)
- Fuzzing File Systems via Two-Dimensional Input Space Exploration, 2019 (https://www.computer.org/csdl/proceedings-article/sp/2019/666000a594/19skfLYOpaw)
- NEUZZ: Efficient Fuzzing with Neural Program Smoothing, 2019 (https://www.computer.org/csdl/proceedings-article/sp/2019/666000a900/19skg5XghG0)
@@ -144,8 +143,7 @@
ACM Conference on Computer and Communications Security (ACM CCS)
- Fuzz on the Beach: Fuzzing Solana Smart Contracts, 2023 (https://arxiv.org/pdf/2309.03006.pdf)
- NestFuzz: Enhancing Fuzzing with Comprehensive Understanding of Input Processing Logic, 2023 
(https://secsys.fudan.edu.cn/_upload/article/files/56/ed/788960544d56a38258aca7d3c8b5/216e599a-d6f6-4308-aa0b-ef45166a8431.pdf)
- NestFuzz: Enhancing Fuzzing with Comprehensive Understanding of Input Processing Logic, 2023 (https://secsys.fudan.edu.cn/_upload/article/files/56/ed/788960544d56a38258aca7d3c8b5/216e599a-d6f6-4308-aa0b-ef45166a8431.pdf)
- Profile-Driven System Optimizations for Accelerated Greybox Fuzzing, 2023 (https://users.cs.utah.edu/~snagy/papers/23CCS.pdf)
- Hopper: Interpretative Fuzzing for Libraries, 2023 (https://arxiv.org/pdf/2309.03496.pdf)
- Greybox Fuzzing of Distributed Systems, 2023 (https://arxiv.org/pdf/2305.02601.pdf)
@@ -215,24 +213,21 @@
Tools
Information about the various open source tools you can use to leverage fuzz testing. The items in this section have been organized and classified based on the standards set by the https://fuzzing-survey.org/ 
website. Although there are currently more than 35 categories, we have selected the most relevant ones to provide efficient information. Additionally, items that are outdated and deprecated have been excluded, 
and only those that are currently usable are listed.
Information about the various open source tools you can use to leverage fuzz testing. The items in this section have been organized and classified based on the standards set by the https://fuzzing-survey.org/ website. Although there are
currently more than 35 categories, we have selected the most relevant ones to provide efficient information. Additionally, items that are outdated and deprecated have been excluded, and only those that are currently usable are listed.
File
- AFL++ (https://github.com/AFLplusplus/AFLplusplus) - AFL++ is a superior fork to Google's AFL - more speed, more and better mutations, more and better instrumentation, custom module support, etc.
- Angora (https://github.com/AngoraFuzzer/Angora) - Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic 
execution.
- Angora (https://github.com/AngoraFuzzer/Angora) - Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Kernel
Network
API
- IvySyn (https://gitlab.com/brown-ssl/ivysyn) - IvySyn is a fully-automated framework for discovering memory error vulnerabilities in Deep Learning (DL) frameworks.
- MINER (https://github.com/puppet-meteor/MINER) - MINER is a REST API fuzzer that utilizes three data-driven designs working together to guide the sequence generation, improve the request generation quality, 
and capture the unique errors caused by incorrect parameter usage.
- MINER (https://github.com/puppet-meteor/MINER) - MINER is a REST API fuzzer that utilizes three data-driven designs working together to guide the sequence generation, improve the request generation quality, and capture the unique 
errors caused by incorrect parameter usage.
- RestTestGen (https://github.com/SeUniVr/RestTestGen) - RestTestGen is a robust tool and framework designed for automated black-box testing of RESTful web APIs.
- GraphFuzz (https://github.com/ForAllSecure/GraphFuzz) - GraphFuzz is an experimental framework for building structure-aware, library API fuzzers.
- Minerva (https://github.com/ChijinZ/Minerva) - Minerva is a browser fuzzer augmented by API mod-ref relations, aiming to synthesize highly-relevant browser API invocations in each test case.
- FANS (https://github.com/iromise/fans) - FANS is a fuzzing tool for fuzzing Android native system services. It contains four components: interface collector, interface model extractor, dependency inferer, and 
fuzzer engine.
- FANS (https://github.com/iromise/fans) - FANS is a fuzzing tool for fuzzing Android native system services. It contains four components: interface collector, interface model extractor, dependency inferer, and fuzzer engine.
JavaScript
Firmware
Hypervisor
@@ -244,8 +239,7 @@
Lib
Web
- TEFuzz (https://github.com/seclab-fudan/TEFuzz/) - TEFuzz is a tailored fuzzing-based framework to facilitate the detection and exploitation of template escape bugs.
- Witcher (https://github.com/sefcom/Witcher) - Witcher is a web application fuzzer that utilizes mutational fuzzing to explore web applications and fault escalation to detect command and SQL injection 
vulnerabilities.
- Witcher (https://github.com/sefcom/Witcher) - Witcher is a web application fuzzer that utilizes mutational fuzzing to explore web applications and fault escalation to detect command and SQL injection vulnerabilities.
- CorbFuzz (https://github.com/shouc/corbfuzz) - CorbFuzz is a state-aware fuzzer for generating as much reponses from a web application as possible without need of setting up database, etc.
DOM
Argument