Package: cobrafuzz
CobraFuzz: Parallel coverage-guided fuzz testing for PythonCobraFuzz is a parallel coverage-guidedfuzzerfor testing Python programs.
It is a fork ofpythonfuzz.Fuzzing for safe languages like Python is a powerful strategy for finding bugs like unhandled exceptions, logic bugs and security bugs.
It makes a good addition to classic unit-testing.UsageFuzz TargetThe first step is to implement a function to be fuzz-tested, also called a fuzz target.
Here is an example of a simple fuzz target for the built-inhtmlmodulefromhtml.parserimportHTMLParserfromcobrafuzz.mainimportCobraFuzz@CobraFuzzdeffuzz(buf):try:string=buf.decode("ascii")parser=HTMLParser()parser.feed(string)exceptUnicodeDecodeError:passif__name__=='__main__':fuzz()Features of a fuzz target:fuzz()will call the fuzz target in an infinite loop with random data generated by the coverage-guided algorithm. The data is passed to the target in a separate process through thebufparameter.The function must catch and ignore any expected exceptions that arise when passing invalid input to the tested program.The fuzz target must call the test function / library with the passed buffer or a transformation on the test buffer if the structure is different or of different type.Fuzz functions can also implement application level checks to catch application or logical bugs. For example: decode the buffer with the library under test, encode it again, and check that both results are equal. To communicate the result, the fuzz target should throw an exception.CobraFuzz will report any unhandled exceptions as crashes.RunningThe next step is to download CobraFuzz and then run the fuzzer:$pipinstallcobrafuzz[...]$pythonexamples/htmlparser/fuzz.py--crash-dirresults--max-crashes1#0READunits:1workers:7seeds:1#1NEWcov:279corp:1exec/s:89crashes:0#5NEWcov:366corp:2exec/s:299crashes:0#7NEWcov:401corp:3exec/s:3124crashes:0[...]#154382NEWcov:1086corp:50exec/s:22835crashes:0#156521NEWcov:1092corp:51exec/s:2797crashes:0Crash dir created (results)sample was written to results/crash-c76ab601df7d8513560ad3c1a38f43c715122b342637a4517a32d13dea03d3cesample = 3c215b2119Found 1 crashes, stopping.By default, CobraFuzz will use all CPUs available in the system (8 in this example: 1 coordination process and 7 independent workers).
Use the-j/--num-workerscommand line parameter to override the default.
In this example an unhandled exception is found in a few seconds.CorpusCobraFuzz will generate and test various inputs in an infinite loop.Seeds can be provided as a mix of files and directories by theseedsparameter.
If one of those seeds parameters is a directory, all regular files therein are used as seeds.
CobraFuzz can also start with an empty seed corpus, though some valid test-cases in the seed corpus may speed up the fuzzing substantially.More fuzz target examples (for real and popular libraries) can be found in the examples directory.Credits & AcknowledgmentsCobraFuzz is a fork ofpythonfuzz.
pythonfuzz is a port offuzzitdev/jsfuzz.
jsfuzz is in turn heavily based ongo-fuzzoriginally developed byDmitry Vyukov.
go-fuzz is in turn heavily based onMichal Zalewski'sAFL.ContributionsContributions are welcome, feel free to open issues and pull requests on GitHub.Trophiespython built-in HTMLParser - unhandled exception (pythonfuzz),twicebeautifulsoup (pythonfuzz)Feel free to add bugs that you found with CobraFuzz to this list via pull requests.