POSTER: AFL-based Fuzzing for Java with Kelinci

R Kersten, K Luckow, CS Păsăreanu - Proceedings of the 2017 ACM …, 2017 - dl.acm.org
Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications …, 2017dl.acm.org
Grey-box fuzzing is a random testing technique that has been shown to be effective at
finding security vulnerabilities in software. The technique leverages program instrumentation
to gather information about the program with the goal of increasing the code coverage
during fuzzing, which makes gray-box fuzzers extremely efficient vulnerability detection
tools. One such tool is AFL, a grey-box fuzzer for C programs that has been used
successfully to find security vulnerabilities and other critical defects in countless software …
Grey-box fuzzing is a random testing technique that has been shown to be effective at finding security vulnerabilities in software. The technique leverages program instrumentation to gather information about the program with the goal of increasing the code coverage during fuzzing, which makes gray-box fuzzers extremely efficient vulnerability detection tools. One such tool is AFL, a grey-box fuzzer for C programs that has been used successfully to find security vulnerabilities and other critical defects in countless software products. We present Kelinci, a tool that interfaces AFL with instrumented Java programs. The tool does not require modifications to AFL and is easily parallelizable. Applying AFL-type fuzzing to Java programs opens up the possibility of testing Java based applications using this powerful technique. We show the effectiveness of Kelinci by applying it on the image processing library Apache Commons Imaging, in which it identified a bug within one hour.
ACM Digital Library