{ "cells": [ { "cell_type": "markdown", "id": "7efdd183", "metadata": {}, "source": [ "# The Fuzzing Book" ] }, { "cell_type": "markdown", "id": "16691489", "metadata": {}, "source": [ "## Sitemap\n", "While the chapters of this book can be read one after the other, there are many possible paths through the book. In this graph, an arrow _A_ → _B_ means that chapter _A_ is a prerequisite for chapter _B_. You can pick arbitrary paths in this graph to get to the topics that interest you most:\n" ] }, { "cell_type": "code", "execution_count": 1, "id": "aa848db3", "metadata": { "execution": { "iopub.execute_input": "2024-04-28T10:52:33.832146Z", "iopub.status.busy": "2024-04-28T10:52:33.831809Z", "iopub.status.idle": "2024-04-28T10:52:33.840104Z", "shell.execute_reply": "2024-04-28T10:52:33.839609Z" } }, "outputs": [], "source": [ "# ignore\n", "from IPython.display import SVG" ] }, { "cell_type": "code", "execution_count": 2, "id": "d827f4fa", "metadata": { "execution": { "iopub.execute_input": "2024-04-28T10:52:33.842995Z", "iopub.status.busy": "2024-04-28T10:52:33.842774Z", "iopub.status.idle": "2024-04-28T10:52:33.859928Z", "shell.execute_reply": "2024-04-28T10:52:33.859523Z" } }, "outputs": [ { "data": { "image/svg+xml": [ "\n", "\n", "\n", "\n", "\n", "Fuzzer\n", "\n", "\n", "\n", "\n", "Fuzzing: Breaking\n", "Things\n", "with Random Inputs\n", "\n", "\n", "\n", "\n", "\n", "Coverage\n", "\n", "\n", "\n", "\n", "Code Coverage\n", "\n", "\n", "\n", "\n", "\n", "Fuzzer->Coverage\n", "\n", "\n", "\n", "\n", "\n", "SearchBasedFuzzer\n", "\n", "\n", "\n", "\n", "Search-Based Fuzzing\n", "\n", "\n", "\n", "\n", "\n", "Fuzzer->SearchBasedFuzzer\n", "\n", "\n", "\n", "\n", "\n", "Grammars\n", "\n", "\n", "\n", "\n", "Fuzzing with\n", "Grammars\n", "\n", "\n", "\n", "\n", "\n", "Fuzzer->Grammars\n", "\n", "\n", "\n", "\n", "\n", "SymbolicFuzzer\n", "\n", "\n", "\n", "\n", "Symbolic Fuzzing\n", "\n", "\n", "\n", "\n", "\n", "Fuzzer->SymbolicFuzzer\n", "\n", "\n", "\n", "\n", "\n", "FuzzingInTheLarge\n", "\n", "\n", "\n", "\n", "Fuzzing in the Large\n", "\n", "\n", "\n", "\n", "\n", "Fuzzer->FuzzingInTheLarge\n", "\n", "\n", "\n", "\n", "\n", "MutationFuzzer\n", "\n", "\n", "\n", "\n", "Mutation-Based\n", "Fuzzing\n", "\n", "\n", "\n", "\n", "\n", "Coverage->MutationFuzzer\n", "\n", "\n", "\n", "\n", "\n", "MutationAnalysis\n", "\n", "\n", "\n", "\n", "Mutation Analysis\n", "\n", "\n", "\n", "\n", "\n", "Coverage->MutationAnalysis\n", "\n", "\n", "\n", "\n", "\n", "GrammarCoverageFuzzer\n", "\n", "\n", "\n", "\n", "Grammar Coverage\n", "\n", "\n", "\n", "\n", "\n", "Coverage->GrammarCoverageFuzzer\n", "\n", "\n", "\n", "\n", "\n", "ProbabilisticGrammarFuzzer\n", "\n", "\n", "\n", "\n", "Probabilistic\n", "Grammar Fuzzing\n", "\n", "\n", "\n", "\n", "\n", "Coverage->ProbabilisticGrammarFuzzer\n", "\n", "\n", "\n", "\n", "\n", "ConcolicFuzzer\n", "\n", "\n", "\n", "\n", "Concolic Fuzzing\n", "\n", "\n", "\n", "\n", "\n", "Coverage->ConcolicFuzzer\n", "\n", "\n", "\n", "\n", "\n", "DynamicInvariants\n", "\n", "\n", "\n", "\n", "Mining Function\n", "Specifications\n", "\n", "\n", "\n", "\n", "\n", "Coverage->DynamicInvariants\n", "\n", "\n", "\n", "\n", "\n", "PythonFuzzer\n", "\n", "\n", "\n", "\n", "Testing Compilers\n", "\n", "\n", "\n", "\n", "\n", "Coverage->PythonFuzzer\n", "\n", "\n", "\n", "\n", "\n", "WhenToStopFuzzing\n", "\n", "\n", "\n", "\n", "When To Stop Fuzzing\n", "\n", "\n", "\n", "\n", "\n", "Coverage->WhenToStopFuzzing\n", "\n", "\n", "\n", "\n", "\n", "GrammarFuzzer\n", "\n", "\n", "\n", "\n", "Efficient Grammar\n", "Fuzzing\n", "\n", "\n", "\n", "\n", "\n", "Grammars->GrammarFuzzer\n", "\n", "\n", "\n", "\n", "\n", "Intro_Testing\n", "\n", "\n", "\n", "\n", "Introduction to\n", "Software Testing\n", "\n", "\n", "\n", "\n", "\n", "Intro_Testing->Fuzzer\n", "\n", "\n", "\n", "\n", "\n", "GreyboxFuzzer\n", "\n", "\n", "\n", "\n", "Greybox Fuzzing\n", "\n", "\n", "\n", "\n", "\n", "MutationFuzzer->GreyboxFuzzer\n", "\n", "\n", "\n", "\n", "\n", "GrammarMiner\n", "\n", "\n", "\n", "\n", "Mining Input\n", "Grammars\n", "\n", "\n", "\n", "\n", "\n", "GrammarCoverageFuzzer->GrammarMiner\n", "\n", "\n", "\n", "\n", "\n", "ConfigurationFuzzer\n", "\n", "\n", "\n", "\n", "Testing\n", "Configurations\n", "\n", "\n", "\n", "\n", "\n", "GrammarCoverageFuzzer->ConfigurationFuzzer\n", "\n", "\n", "\n", "\n", "\n", "Carver\n", "\n", "\n", "\n", "\n", "Carving Unit Tests\n", "\n", "\n", "\n", "\n", "\n", "GrammarCoverageFuzzer->Carver\n", "\n", "\n", "\n", "\n", "\n", "GUIFuzzer\n", "\n", "\n", "\n", "\n", "Testing Graphical\n", "User Interfaces\n", "\n", "\n", "\n", "\n", "\n", "GrammarCoverageFuzzer->GUIFuzzer\n", "\n", "\n", "\n", "\n", "\n", "APIFuzzer\n", "\n", "\n", "\n", "\n", "Fuzzing APIs\n", "\n", "\n", "\n", "\n", "\n", "ProbabilisticGrammarFuzzer->APIFuzzer\n", "\n", "\n", "\n", "\n", "\n", "GreyboxGrammarFuzzer\n", "\n", "\n", "\n", "\n", "Greybox Fuzzing with\n", "Grammars\n", "\n", "\n", "\n", "\n", "\n", "GreyboxFuzzer->GreyboxGrammarFuzzer\n", "\n", "\n", "\n", "\n", "\n", "GrammarFuzzer->GrammarCoverageFuzzer\n", "\n", "\n", "\n", "\n", "\n", "GrammarFuzzer->PythonFuzzer\n", "\n", "\n", "\n", "\n", "\n", "Parser\n", "\n", "\n", "\n", "\n", "Parsing Inputs\n", "\n", "\n", "\n", "\n", "\n", "GrammarFuzzer->Parser\n", "\n", "\n", "\n", "\n", "\n", "GeneratorGrammarFuzzer\n", "\n", "\n", "\n", "\n", "Fuzzing with\n", "Generators\n", "\n", "\n", "\n", "\n", "\n", "GrammarFuzzer->GeneratorGrammarFuzzer\n", "\n", "\n", "\n", "\n", "\n", "Reducer\n", "\n", "\n", "\n", "\n", "Reducing Failure-\n", "Inducing Inputs\n", "\n", "\n", "\n", "\n", "\n", "GrammarFuzzer->Reducer\n", "\n", "\n", "\n", "\n", "\n", "FuzzingWithConstraints\n", "\n", "\n", "\n", "\n", "Fuzzing with\n", "Constraints\n", "\n", "\n", "\n", "\n", "\n", "GrammarFuzzer->FuzzingWithConstraints\n", "\n", "\n", "\n", "\n", "\n", "WebFuzzer\n", "\n", "\n", "\n", "\n", "Testing Web\n", "Applications\n", "\n", "\n", "\n", "\n", "\n", "GrammarFuzzer->WebFuzzer\n", "\n", "\n", "\n", "\n", "\n", "Parser->ProbabilisticGrammarFuzzer\n", "\n", "\n", "\n", "\n", "\n", "Parser->GreyboxGrammarFuzzer\n", "\n", "\n", "\n", "\n", "\n", "InformationFlow\n", "\n", "\n", "\n", "\n", "Tracking Information\n", "Flow\n", "\n", "\n", "\n", "\n", "\n", "Parser->InformationFlow\n", "\n", "\n", "\n", "\n", "\n", "GeneratorGrammarFuzzer->APIFuzzer\n", "\n", "\n", "\n", "\n", "\n", "WebFuzzer->GUIFuzzer\n", "\n", "\n", "\n", "\n", "\n", "InformationFlow->ConcolicFuzzer\n", "\n", "\n", "\n", "\n", "\n", "InformationFlow->GrammarMiner\n", "\n", "\n", "\n", "\n", "\n", "APIFuzzer->Carver\n", "\n", "\n", "\n", "\n", "" ], "text/plain": [ "" ] }, "execution_count": 2, "metadata": {}, "output_type": "execute_result" } ], "source": [ "# ignore\n", "SVG(filename='PICS/Sitemap.svg')" ] }, { "cell_type": "markdown", "id": "c8d8fb3a", "metadata": {}, "source": [ "## [Table of Contents](index.ipynb)\n", "\n", "\n", "### Part I: Whetting Your Appetite\n", "\n", "* Tours through the Book\n", "* Introduction to Software Testing\n", "\n", "### Part II: Lexical Fuzzing\n", "\n", "* Fuzzing: Breaking Things with Random Inputs\n", "* Code Coverage\n", "* Mutation-Based Fuzzing\n", "* Greybox Fuzzing\n", "* Search-Based Fuzzing\n", "* Mutation Analysis\n", "\n", "### Part III: Syntactic Fuzzing\n", "\n", "* Fuzzing with Grammars\n", "* Efficient Grammar Fuzzing\n", "* Grammar Coverage\n", "* Parsing Inputs\n", "* Probabilistic Grammar Fuzzing\n", "* Fuzzing with Generators\n", "* Greybox Fuzzing with Grammars\n", "* Reducing Failure-Inducing Inputs\n", "\n", "### Part IV: Semantic Fuzzing\n", "\n", "* Fuzzing with Constraints\n", "* Mining Input Grammars\n", "* Tracking Information Flow\n", "* Concolic Fuzzing\n", "* Symbolic Fuzzing\n", "* Mining Function Specifications\n", "\n", "### Part V: Domain-Specific Fuzzing\n", "\n", "* Testing Configurations\n", "* Fuzzing APIs\n", "* Carving Unit Tests\n", "* Testing Compilers\n", "* Testing Web Applications\n", "* Testing Graphical User Interfaces\n", "\n", "### Part VI: Managing Fuzzing\n", "\n", "* Fuzzing in the Large\n", "* When To Stop Fuzzing\n", "\n", "### Appendices\n", "\n", "* Academic Prototyping\n", "* Prototyping with Python\n", "* Error Handling\n", "* Timer\n", "* Timeout\n", "* Class Diagrams\n", "* Railroad Diagrams\n", "* Control Flow Graph\n" ] } ], "metadata": { "ipub": { "bibliography": "fuzzingbook.bib" }, "kernelspec": { "display_name": "Python 3", "language": "python", "name": "python3" }, "language_info": { "codemirror_mode": { "name": "ipython", "version": 3 }, "file_extension": ".py", "mimetype": "text/x-python", "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", "version": "3.10.2" }, "toc": { "base_numbering": 1, "nav_menu": {}, "number_sections": true, "sideBar": true, "skip_h1_title": true, "title_cell": "", "title_sidebar": "Contents", "toc_cell": false, "toc_position": {}, "toc_section_display": true, "toc_window_display": true }, "toc-autonumbering": false }, "nbformat": 4, "nbformat_minor": 5 }