Java Fuzzing With Jazzer | New Features Simplify Fuzz Testing

Показать описание

Since Code Intelligence’s Java fuzzer “Jazzer” has been open-sourced in Febrary 2021, it has found over 200 bugs and vulnerabilities in popular open-source libraries such as jsoup, Jackson and Apache Commons. In this introduction, I want to highlight some of the features that Jazzer has gained since its initial release:
1) macOS and Windows support
2) Autofuzz – start fuzzing with just a .jar and a method name!
3) Bug detectors for certain high-severity vulnerability classes (e.g. unsafe deserialization/reflection)

Content
00:00 - Intro
00:54 - What is Jazzer?
01:58 - Requirements and features
05:05 - What bugs can you find with Jazzer?
08:11 - Write your own bug detectors
12:48 - Autofuzz helps you to set up fuzz tests
19:28 - More features
22:05 - Closing thoughts

Sources:
[1] About Jazzer
[2] What is Fuzz Testing?
[3] What Bugs Can You Find With Fuzzing?
[4] Link to Jazzer GitHub Repository (Open-Source)
[5] Fabian Meumertzheim on Twitter