But what exactly are you fuzzing without being protocol specific as you start fuzzing? How do you eliminate false positive? You can be generative with grammar or with some learning capability (as "dumb" as aligning similar traffic as a cluster for example).
I am not sure how you are distinguishing my theoretical protocol agnostic fuzzer from afl. Is afl a jpg/png specific fuzzer? One of the things that is great about afl is that it is not targeted towards a specific file format it can work with a small corpus or thorough dictionary of the target format. eg I can give afl-fuzz a snippet of two of markdown and it will go nuts or if I want to be exhaustive I can feed afl the afl "dictionary" from the commonmark testsuite.
How do you ever eliminate false positives when fuzzing? And what constitutes a false positive?
having only read about the usage and successes of AFL, I'm curious what you would "feed" this network protocol debugger. a grammar file (something like BinPAC++ [0]) or something else entirely?
Comments
But what exactly are you fuzzing without being protocol specific as you start fuzzing? How do you eliminate false positive? You can be generative with grammar or with some learning capability (as "dumb" as aligning similar traffic as a cluster for example).
I am not sure how you are distinguishing my theoretical protocol agnostic fuzzer from afl. Is afl a jpg/png specific fuzzer? One of the things that is great about afl is that it is not targeted towards a specific file format it can work with a small corpus or thorough dictionary of the target format. eg I can give afl-fuzz a snippet of two of markdown and it will go nuts or if I want to be exhaustive I can feed afl the afl "dictionary" from the commonmark testsuite.
How do you ever eliminate false positives when fuzzing? And what constitutes a false positive?
having only read about the usage and successes of AFL, I'm curious what you would "feed" this network protocol debugger. a grammar file (something like BinPAC++ [0]) or something else entirely?
[0] http://www.icir.org/hilti/binpac/intro.html
A PCAP file of captured traffic?