Hacker News Reader

Comment by nchammas | Hacker News Reader

On the topic of fuzz testing, Python has an excellent library for property-based testing called Hypothesis [0] [1]. I don't think it does guided testing like AFL or libFuzzer (which OSS-Fuzz uses), but it's very powerful nonetheless.

[0] http://hypothesis.works/

[1] https://github.com/HypothesisWorks/hypothesis-python

View on HN

I developed a fuzzer that generates random values based on ABNF rules, such as often appear in IETF RFCs. So it can be used for testing RFC implementations. It's written in Java but can be called from other tools.

https://github.com/nradov/abnffuzzer

There is a good wrapper for afl, https://pypi.python.org/pypi/python-afl that allows you to relatively easily use afl with your python code. Just be sure to take advantage of looping or you'll be limited by the python runtime start-up overhead.

Seconded. I've used it for testing various functions in recommendation systems, and it's great at finding boundary conditions you didn't think of, or issues with floating point math. And, as it was the first time I used any testing tools like this, it was a fun emotional experience to have an antagonistic test suite.

I wrote a wrapper around CPython for fuzz testing with libFuzzer [1]. It's dog slow because it's designed for anyone to be able to write relatively simple test cases in Python (so every iteration of the fuzzer starts the interpreter, executes the test, tears it down...). But a neat concept IMHO.

[1] https://bitbucket.org/ebadf/fuzzpy

We developed a fuzzer [0] using property-based testing in Haskell using QuickCheck (as expected!)

[0] http://QuickFuzz.org/

Since people are listing fuzzers, there are also the commercial alternatives: Peach Fuzzer (www.peachfuzzer.com/) and Synopsys Defensics (https://goo.gl/wroKI8‎). While my experience is not that recent, these two seem to dominate the network protocol fuzzing domain, whereas some of the open alternatives listed here appear to have become superior in general purpose 'parser' fuzzing. That said, played with honggfuzz recently and it really shows promise, especially if you have access to the source code (https://github.com/google/honggfuzz).

Reply on news.ycombinator.com