Three Colours of Fuzzing: Reflections and Open Challenges
summary
Compares whitebox, greybox and blackbox fuzzing with concrete tools and results: CLE (symbolic execution) runs forever experiments and times out on some CVEs while a speculative pruning technique called chopped symbolic execution (Chopper) reproduces three vulnerabilities quickly; a grammar-mutation engine finds 10 confirmed bugs (6 fixed) plus 3 faulty grammars; targeted patch testing uses product programs and patch specifications to detect real regressions in coreutils (an LS refactor bug found and then a subtle double-slash behavior documented).
AI-written summary · about
chapters (14)
- 0:00Fuzzing introduction
- 2:08Blackbox grammar-based fuzzing
- 3:59Graybox coverage-guided fuzzing
- 5:25Whitebox symbolic execution
- 7:56CLE and academic impact
- 9:43Manual testing findings
- 16:09Input generation challenges
- 21:50Grammar mutation for testing
- 23:57Patch coverage testing
- 27:31Chopped symbolic execution
- 32:29The oracle problem
- 34:37Patch specifications
- 42:29AI-assisted fuzzing future
- 44:39Q&A
related talks
52mStructure aware fuzzing
01h 15mMake your programs more reliable with Fuzzing
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
25mGoing Beyond Coverage-Guided Fuzzing with Structured Fuzzing
39mFuzzing: Finding Your Own Bugs and 0days!
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
53mFuzz Testing for Fun and Profit
31m“Fuzz or lose..."