Abstract:In recent years, the fuzzing technology is widely used to detect the software vulnerabilities owing to the coverage improvement in the target program and the easiness of use. However, it is less efficient to fuzz the stateful protocols due to the difficulties like maintaining states and dependencies of messages. To address these challenges, we present SPFuzz, a framework for building flexible, coverage-guided stateful protocol fuzzing. We define a language in SPFuzz to describe the protocol specifications, protocol states transitions and dependencies for generating valuable test cases, maintaining correct messages in session states and handling protocol dependencies by updating message data in time. The SPFuzz adopts a three-level mutation strategy, namely head, content, and sequence mutation strategy to drive the fuzzing process to cover more paths, in conjunction with the method to randomly assign weights to messages and strategies. We use the following metrics to evaluate the performance of SPFuzz and other frameworks upon three protocol implementations, i.e., Proftpd, Oftpd, and OpenSSL, which are three-granularity coverages specifically function, basic block, and edge. In experiments, the SPFuzz framework outperforms the existing stateful protocol fuzzing tool Boofuzz by an average of 69.12% in three granularities coverage tests. This demonstrates that the SPFuzz has the ability to explore more and deeper paths of the target program. We further triggered CVE-2015-0291 in OpenSSL 1.0.2 with the SPFuzz, which proves the validity and utility of our framework.

A Survey of Network Protocol Fuzzing: Model, Techniques and Directions

A Survey on the Development of Network Protocol Fuzzing Techniques

A Survey of Protocol Fuzzing

Network protocol fuzz testing for information systems and applications: a survey and taxonomy

Model-Based Grey-Box Fuzzing of Network Protocols

The Art, Science, and Engineering of Fuzzing: A Survey

A Novel Protocol Fuzz Testing Approach

Protocol Fuzzing with Specification Guided Message Generation.

Exploring Effective Fuzzing Strategies to Analyze Communication Protocols

Fuzzing Improving Techniques Applied and Evaluated on a Network Traffic Analysis System

NAFuzzer: Augmenting Network Protocol Fuzzers Via Automatic Template and Seed Generation

Survey on Fuzzing

FuzzFabric: A Scalable Grey-box Fuzzing Framework for Polymorphic Network Services

Survey of OS Kernel Fuzzing

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

Fuzzing: A Survey for Roadmap

MSFuzz: Augmenting Protocol Fuzzing with Message Syntax Comprehension Via Large Language Models

State Selection Algorithms and Their Impact on The Performance of Stateful Network Protocol Fuzzing

A Comprehensive Survey on Database Management System Fuzzing: Techniques, Taxonomy and Experimental Comparison

SPFuzz: A Hierarchical Scheduling Framework for Stateful Network Protocol Fuzzing