<story><title>Ask HN: What is the emerging state of the art in fuzzing techniques?</title><text>I&amp;#x27;m fairly familiar with the popular tools such as afl and Codenomicon Defensics. But I find the academic literature very opaque and don&amp;#x27;t really know where to start.&lt;p&gt;If I want to understand the cutting edge of fuzzing techniques, and what will be the emerging state of the art in the next few years - where should I look? Any good papers or books (with at least some for novices to understand), or research projects that are leading towards a new excellence?</text></story><parent_chain></parent_chain><comment><author>wepple</author><text>in general, have a poke around &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fuzzing.info&amp;#x2F;papers&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fuzzing.info&amp;#x2F;papers&amp;#x2F;&lt;/a&gt;&lt;p&gt;First, I think the next big step in fuzzing will actually be a &lt;i&gt;complement&lt;/i&gt; to fuzzing - solving.&lt;p&gt;AFL and friends can bitbang their way to massive code coverage, but can still fail on fairly simple testcases. Some recent research[1] by the authors of Angr[2] show that by pairing the brute-force coverage and exception discovery of a tool like AFL with constraint solving tools can really dig deep into a program, by actually solving the path to a given block of code. Microsoft&amp;#x27;s infamous SAGE fuzzer does this IIRC.&lt;p&gt;Second, I think there are still massive oportunities for fuzzing closed-source programs, as well as programs with tricky state, such as browsers or network daemons.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.internetsociety.org&amp;#x2F;sites&amp;#x2F;default&amp;#x2F;files&amp;#x2F;blogs-media&amp;#x2F;driller-augmenting-fuzzing-through-selective-symbolic-execution.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.internetsociety.org&amp;#x2F;sites&amp;#x2F;default&amp;#x2F;files&amp;#x2F;blogs-me...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;angr.io&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;angr.io&lt;/a&gt;</text></comment>
<story><title>Ask HN: What is the emerging state of the art in fuzzing techniques?</title><text>I&amp;#x27;m fairly familiar with the popular tools such as afl and Codenomicon Defensics. But I find the academic literature very opaque and don&amp;#x27;t really know where to start.&lt;p&gt;If I want to understand the cutting edge of fuzzing techniques, and what will be the emerging state of the art in the next few years - where should I look? Any good papers or books (with at least some for novices to understand), or research projects that are leading towards a new excellence?</text></story><parent_chain></parent_chain><comment><author>robto</author><text>I&amp;#x27;ve started using clojure.spec[0] in my regular day programming with an eye on using generative testing, which I understand is a form of fuzzing. I&amp;#x27;m very new to this, but it feels incredibly practical in terms of bang for buck - like the &amp;#x27;cutting edge&amp;#x27; of practical use. I&amp;#x27;m not sure what it&amp;#x27;s academic background is, but I&amp;#x27;d highly recommend reading and listening to what Rich Hickey has to say about it. He&amp;#x27;s a smart guy.&lt;p&gt;[0]&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;clojure.org&amp;#x2F;about&amp;#x2F;spec&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;clojure.org&amp;#x2F;about&amp;#x2F;spec&lt;/a&gt;
[1]&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;blog.cognitect.com&amp;#x2F;cognicast&amp;#x2F;103&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.cognitect.com&amp;#x2F;cognicast&amp;#x2F;103&lt;/a&gt;</text></comment>