CERT Basic Fuzzing Framework (BFF)

The CERT Basic Fuzzing Framework (BFF) is a software testing tool that
finds defects in applications that run on the Linux and Mac OS X
platforms. BFF performs mutational fuzzing on software that consumes
file input. (Mutational fuzzing is the act of taking well-formed
input data and corrupting it in various ways, looking for cases that
cause crashes.)

The BFF automatically collects test cases that cause
software to crash in unique ways, as well as debugging information
associated with the crashes. The goal of BFF is to minimize the effort
required for software vendors and security researchers to efficiently
discover and analyze security vulnerabilities found via fuzzing. 

Traditionally fuzzing has been very effective at finding security
vulnerabilities, but because of its inherently stochastic nature
results can be highly dependent on the initial configuration of the
fuzzing system. BFF applies machine learning and evolutionary
computing techniques to minimize the amount of manual configuration
required to initiate and complete an effective fuzzing campaign. BFF
adjusts its configuration parameters based on what it finds (or does
not find) over the course of a fuzzing campaign. By doing so it can
dramatically increase both the efficacy and efficiency of the
campaign. As a result, expert knowledge is not required to configure
an effective fuzz campaign, and novices and experts alike can start
finding and analyzing vulnerabilities very quickly.

Some of the specific features BFF offers are:

  • Minimal initial configuration is required to start a
    fuzzing campaign
  • Minimal supervision of the fuzzing campaign is required,
    as BFF can automatically recover from many common problems
    that can interrupt fuzzing campaigns
  • Uniqueness determination through intelligent backtrace
  • Automated test case minimization reduces the effort
    required to analyze results by distilling the test case to the
    minimal changes to the input data required to induce a
    specific crash
  • Online machine learning applied to fuzzing parameter and
    input file selection to improve the efficacy of the
  • Distributed fuzzing support
  • Crash severity / exploitability triage

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

What Makes ICS/OT Infrastructure Vulnerable?

Infrastructure security for operational technologies (OT) and industrial control systems (ICS) varies from IT security in several ways, with the inverse confidentiality, integrity, and...

Everything You Must Know About IT/OT Convergence

What is an Operational Technology (OT)? Operational technology (OT) is a technology that primarily monitors and controls physical operations. It can automate and control machines,...

Understand the OT Security and Its Importance

This article discusses OT security and why it is essential for protecting industrial systems from cyberattacks. We will also discuss common control objectives that can...

What is Deepfake, and how does it Affect Cybersecurity?

Producing deepfake is easy. It is hard to detect. They operate with a description of reality rather than reality itself (e.g., a video). Any...