Slashdot Mirror
CERT Releases Basic Fuzzing Framework
infoLaw passes along this excerpt from Threatpost: "Carnegie Mellon University's Computer Emergency Response Team has released a new fuzzing framework to help identify and eliminate security vulnerabilities from software products. The Basic Fuzzing Framework (BFF) is described as a simplified version of automated dumb fuzzing. It includes a Linux virtual machine that has been optimized for fuzz testing and a set of scripts to implement a software test."
Anything that you write that uses a regex you should beat on with some fuzzing logic, since they can tend to increase in computational time non-linearly, and next thing you know you got a DOS on your hands.
TIP OF THE DAY for you FROM ME
And urgently needed. So far the CMU/CERT software I had a look at was pretty good....
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Sort of like this?
in their whitepaper they referenced my 'axfuzz' tool I wrote years ago and even used a modified version of it in their testing. Hope they didn't judge me on that code, it was a pile of crap that I kept hacking together until it finally worked, with no thought to proper software design.
I.O.U One Sig.
The worst case scenario is talking about worse case scenarios thinking about worse case scenarios and letting them possess you.
The game.
Oh FFS, you couldn't even link to the damn framework?
BFF? What an unfortunate choice of acronyms.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
I propose that every website which handles private data (credit, ssn, health, etc) should be integrating these kinds of tools into normal test procedures, both in development and on production mirrored sites.
Hear hear!
I said no... but I missed and it came out yes.
But for me it's simply about learning the conventions/idioms of whatever language/system you're programming in and taking some fucking pride in your work.
My code has actually become worse since I moved from academia to industry -- at least, I've been "forced" into a lot more hacks. Two reasons: Shortsightedness on the part of stakeholders/PHBs and the fact that you cannot afford to rewrite absurdly broken code written by your coworkers. Sad but true.
Bitches! If I ever see somebody IRL who tells me he's a slashdot editor, god I swear I will punch him.
"in their whitepaper they referenced my 'axfuzz' tool I wrote years ago and even used a modified version of it in their testing. Hope they didn't judge me on that code, it was a pile of crap that I kept hacking together until it finally worked, with no thought to proper software design." - by shird (566377) on Thursday May 27, @09:48PM (#32371160) Homepage
Per my subject-line above: My "hat's off" to you man, in terms of "good job on your end". It's always nice (and, a treat) to see that someone from this website (or rather, someone that frequents it) has actually produced something of use that's for "the common good", or used by others even (right up there with being imitated, as far as "flattery")!
(Change, REAL CHANGE? Starts with YOU, & you exemplify this via your works here!)
APK
P.S.=> The funniest part is, is this (and, I am sure you are aware of it, based on your works): Anyone AND EVERYONE has this type of potential, IF they apply themselves!
You seem to "berate yourself" for your code... don't!
(& yes, I know how that is, looking back on code you wrote YEARS (if not decades) before & saying to yourself "WTF? I did THAT?? I am amazed it works @ all!"... but, this is only your own personal growth/progress showing through, because you're now aware of how you could have done it better (a great sign really - imo @ least? It means you're growing & improving!)).
You KNOW the deal, i.e.-> That You'll fail a few times, @ first, but then? THEN, you get it working @ least. For starters... then you can improve on it, IF you wish, & that, as I am also sure you know, takes time & observations + inference (been there recently on an app I wrote to remove duplicates from a HOSTS file I build. I wrote the 1st version in 2002, it utterly sucked. I later rewrote it (I used Borland Delphi because it's THE fastest in strings + math work, doubling MSVC++ even in Visual Basic Programmer's Journal 1997 issue "Inside the VB5 Compiler Engine")).
Near the end, & got it down to 1 hr. processing time over 1 million records, down from 2 hrs. processing/parsing time... Anyhow/anyhow: I "hit the wall", & couldn't get the code any faster (inline asm & all, + compiler optimizations & by hand ones via profiling and identifying the slowest area) - this "perturbed me".
HOWEVER, at the very end, it took me looking @ THE DATA ITSELF, & how I was parsing + processing it (1 large file) & it made a HUGE diff. in how fast it processed removal of HOSTS file duplicates (yes, a SELECT DISTINCT type query in an indexed DB engine can do it faster, but, I don't even use indexing in mine (don't feel like implementing a b-tree either) & it's really a tool for those of us that don't "do SQL" (I do, but meaning others here), or possess a DB engine to do so (though mySQL server is free, not everyone's mastered SQL).
So, how'd I improve it? AGAIN - Not in the code itself, but in the data!
Heck - I ended up "busting up" the 1++ million records into 8 equal parts, all sorted, & now I have the thing down to 24 minutes processing time, vs. its original mark of 2++ hrs.!
(Sure, I could have altered the algorithm in code I used, seeing it favors "smaller/smallish" datasets over larger ones for deduplication of entries, but this worked gangbusters, so I went with it!).
SO, I guess you could say "I KNOW THE FEELING" (on what I quote from you)...
In the end? Great job, you've done something SO WELL, others "bit off your style" man... kudos! This world needs more "creative types" like you out there, helping improve it (that's MY "bottom-line" here), & once more? Always cool to see another "creative type" here on this website (you're a rarity imo & observations here @ least, the past 7++ yrs. or so visiting here)...apk