CERT Basic Fuzzing Framework (BFF)

The CERT Basic Fuzzing Framework (BFF) is a software testing tool that
finds defects in applications that run on the Linux and Mac OS X
platforms. BFF performs mutational fuzzing on software that consumes
file input. (Mutational fuzzing is the act of taking well-formed
input data and corrupting it in various ways, looking for cases that
cause crashes.)

The BFF automatically collects test cases that cause
software to crash in unique ways, as well as debugging information
associated with the crashes. The goal of BFF is to minimize the effort
required for software vendors and security researchers to efficiently
discover and analyze security vulnerabilities found via fuzzing. 

Traditionally fuzzing has been very effective at finding security
vulnerabilities, but because of its inherently stochastic nature
results can be highly dependent on the initial configuration of the
fuzzing system. BFF applies machine learning and evolutionary
computing techniques to minimize the amount of manual configuration
required to initiate and complete an effective fuzzing campaign. BFF
adjusts its configuration parameters based on what it finds (or does
not find) over the course of a fuzzing campaign. By doing so it can
dramatically increase both the efficacy and efficiency of the
campaign. As a result, expert knowledge is not required to configure
an effective fuzz campaign, and novices and experts alike can start
finding and analyzing vulnerabilities very quickly.

Some of the specific features BFF offers are:

  • Minimal initial configuration is required to start a
    fuzzing campaign
  • Minimal supervision of the fuzzing campaign is required,
    as BFF can automatically recover from many common problems
    that can interrupt fuzzing campaigns
  • Uniqueness determination through intelligent backtrace
  • Automated test case minimization reduces the effort
    required to analyze results by distilling the test case to the
    minimal changes to the input data required to induce a
    specific crash
  • Online machine learning applied to fuzzing parameter and
    input file selection to improve the efficacy of the
  • Distributed fuzzing support
  • Crash severity / exploitability triage

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

How to Install Kali Linux on VirtualBox [Windows Host] in 2020

Kali Linux is a Debian based Linux distribution, released on the 13th March 2013 as a complete rebuild of BackTrack Linux. It is one of...

Acunetix v13 Release Introduces Groundbreaking Innovations

The newest release of the Acunetix Web Vulnerability Scanner further improves performance and premieres best-of-breed technologies London, United Kingdom – February 5, 2019 – Acunetix,...

What is Ethical Hacking, how to be an Ethical Hacker

Hacking is the process of discovering vulnerabilities in a system and using these found vulnerabilities by gaining unauthorized access into the system to perform...

Basic steps to ensure security Online!

Security concerns are growing day by day due to the growing interconnectivity and technology. Drastic things can happen if you be a little careless...