Going Beyond Coverage-Guided Fuzzing with Structured Fuzzing

Coverage-guided fuzzers like AFL and libFuzzer have led to a "fuzzing renaissance". This is because they made it possible for security researchers to write effective fuzzers for formats without knowing about the format's structure. However, structure-aware (aka structured) fuzzing is far from dead. In fact, the combination of structured and coverage-guided (aka coverage) fuzzing has quietly become the state of the art in automated vulnerability discovery.
By Jonathan Metzman
Full Abstract & Presentation Materials: www.blackhat.c...