Automated Black-Box Fuzzer

Offensive Security Completed

Overview

A black-box fuzzing harness built with a 4-person team for COMP6447 (UNSW's Introduction to Secure Programming). Given a folder of target binaries and sample inputs, the harness uses libmagic to detect input type and routes each sample through both mutation-based fuzzing (bit-flip, byte-flip, arithmetic boundary, known-integer, copy-extend, and token-insertion mutators) and format-aware generation fuzzing tailored to JSON, XML, CSV, TXT, PDF, JPEG, and ELF inputs — including direct manipulation of ELF header, program header, and section header fields via pyelftools. Crashes are triaged by inspecting the subprocess exit signal and stderr (e.g. flagging stack-smashing detections while ignoring benign abort() calls), with failing inputs written out for reproduction. The whole pipeline runs in Docker with a GitHub Actions workflow that builds and runs the fuzzer on every push. My contributions were the PDF and JPEG generation fuzzers, the token-insertion mutator, and the Docker/CI setup.

Key Features

▸ Mutation-based fuzzing: bit-flip, byte-flip, arithmetic boundary, known-integer, copy-extend, and token-insertion mutators
▸ Format-aware generation fuzzers for JSON, XML, CSV, TXT, PDF, JPEG, and ELF inputs
▸ libmagic-based MIME detection to route each input to the right fuzzing strategy
▸ ELF header, program header, and section header field fuzzing via pyelftools
▸ Crash triage via subprocess signal and stderr inspection (e.g. stack-smashing detection)
▸ Dockerized harness with GitHub Actions CI on every push