Average Ratings 0 Ratings
Average Ratings 0 Ratings
Description
Atheris is a Python fuzzing engine guided by coverage, designed to test both Python code and native extensions developed for CPython. It is built on the foundation of libFuzzer, providing an effective method for identifying additional bugs when fuzzing native code. Atheris is compatible with Linux (both 32- and 64-bit) and Mac OS X, supporting Python versions ranging from 3.6 to 3.10. Featuring an integrated libFuzzer, it is well-suited for fuzzing Python applications, but when targeting native extensions, users may need to compile from source to ensure compatibility between the libFuzzer version in Atheris and their Clang installation. Since Atheris depends on libFuzzer, which is a component of Clang, users of Apple Clang will need to install a different version of LLVM, as the default does not include libFuzzer. The implementation of Atheris as a coverage-guided, mutation-based fuzzer (LibFuzzer) simplifies the setup process by eliminating the need for input grammar definition. However, this approach can complicate the generation of inputs for code that processes intricate data structures. Consequently, while Atheris offers ease of use in many scenarios, it may face challenges when dealing with more complex parsing requirements.
Description
FuzzDB was developed to enhance the chances of identifying security vulnerabilities in applications through dynamic testing methods. As the first and most extensive open repository of fault injection patterns, along with predictable resource locations and regex for server response matching, it serves as an invaluable resource. This comprehensive database includes detailed lists of attack payload primitives aimed at fault injection testing. The patterns are organized by type of attack and, where applicable, by the platform, and they are known to lead to vulnerabilities such as OS command injection, directory listings, directory traversals, source code exposure, file upload bypass, authentication bypass, cross-site scripting (XSS), HTTP header CRLF injections, SQL injection, NoSQL injection, and several others. For instance, FuzzDB identifies 56 patterns that might be interpreted as a null byte, in addition to offering lists of frequently used methods and name-value pairs that can activate debugging modes. Furthermore, the resource continuously evolves as it incorporates new findings and community contributions to stay relevant against emerging threats.
API Access
Has API
API Access
Has API
Integrations
BlackArch Linux
Google OSS-Fuzz
LibFuzzer
NoSQL
OWASP ZAP
Python
Integrations
BlackArch Linux
Google OSS-Fuzz
LibFuzzer
NoSQL
OWASP ZAP
Python
Pricing Details
Free
Free Trial
Free Version
Pricing Details
Free
Free Trial
Free Version
Deployment
Web-Based
On-Premises
iPhone App
iPad App
Android App
Windows
Mac
Linux
Chromebook
Deployment
Web-Based
On-Premises
iPhone App
iPad App
Android App
Windows
Mac
Linux
Chromebook
Customer Support
Business Hours
Live Rep (24/7)
Online Support
Customer Support
Business Hours
Live Rep (24/7)
Online Support
Types of Training
Training Docs
Webinars
Live Training (Online)
In Person
Types of Training
Training Docs
Webinars
Live Training (Online)
In Person
Vendor Details
Company Name
Website
github.com/google/atheris
Vendor Details
Company Name
FuzzDB
Website
github.com/fuzzdb-project/fuzzdb