about summary refs log tree commit diff
path: root/docs/guided_fuzzing.md
diff options
context:
space:
mode:
authorllzmb <46303940+llzmb@users.noreply.github.com>2021-09-03 17:08:54 +0200
committerllzmb <46303940+llzmb@users.noreply.github.com>2021-09-03 17:08:54 +0200
commitc206fb319b18c1edf338150df6c6a76f2f0b51a1 (patch)
tree6001705edc2178cb4ad9dffa09ede6c9d4e9d3b7 /docs/guided_fuzzing.md
parentdc1f93cf8cc722ad291e8c3e7df55528b5d6a0e9 (diff)
downloadafl++-c206fb319b18c1edf338150df6c6a76f2f0b51a1.tar.gz
Edit README.md and related content
Diffstat (limited to 'docs/guided_fuzzing.md')
-rw-r--r--docs/guided_fuzzing.md25
1 files changed, 0 insertions, 25 deletions
diff --git a/docs/guided_fuzzing.md b/docs/guided_fuzzing.md
deleted file mode 100644
index 44fd44a4..00000000
--- a/docs/guided_fuzzing.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# Challenges of guided fuzzing
-
-Fuzzing is one of the most powerful and proven strategies for identifying
-security issues in real-world software; it is responsible for the vast
-majority of remote code execution and privilege escalation bugs found to date
-in security-critical software.
-
-Unfortunately, fuzzing is also relatively shallow; blind, random mutations
-make it very unlikely to reach certain code paths in the tested code, leaving
-some vulnerabilities firmly outside the reach of this technique.
-
-There have been numerous attempts to solve this problem. One of the early
-approaches - pioneered by Tavis Ormandy - is corpus distillation. The method
-relies on coverage signals to select a subset of interesting seeds from a
-massive, high-quality corpus of candidate files, and then fuzz them by
-traditional means. The approach works exceptionally well but requires such
-a corpus to be readily available. In addition, block coverage measurements
-provide only a very simplistic understanding of the program state and are less
-useful for guiding the fuzzing effort in the long haul.
-
-Other, more sophisticated research has focused on techniques such as program
-flow analysis ("concolic execution"), symbolic execution, or static analysis.
-All these methods are extremely promising in experimental settings, but tend
-to suffer from reliability and performance problems in practical uses - and
-currently do not offer a viable alternative to "dumb" fuzzing techniques.
\ No newline at end of file