CIP Cyber

CERT Basic Fuzzing Framework (BFF)

Table of Contents


The CERT Basic Fuzzing Framework (BFF) is a software testing tool that
finds defects in applications that run on the Linux and Mac OS X
platforms. BFF performs mutational fuzzing on software that consumes
file input. (Mutational fuzzing is the act of taking well-formed
input data and corrupting it in various ways, looking for cases that
cause crashes.)


The BFF automatically collects test cases that cause
software to crash in unique ways, as well as debugging information
associated with the crashes. The goal of BFF is to minimize the effort
required for software vendors and security researchers to efficiently
discover and analyze security vulnerabilities found via fuzzing. 

Traditionally fuzzing has been very effective at finding security
vulnerabilities, but because of its inherently stochastic nature
results can be highly dependent on the initial configuration of the
fuzzing system. BFF applies machine learning and evolutionary
computing techniques to minimize the amount of manual configuration
required to initiate and complete an effective fuzzing campaign. BFF
adjusts its configuration parameters based on what it finds (or does
not find) over the course of a fuzzing campaign. By doing so it can
dramatically increase both the efficacy and efficiency of the
campaign. As a result, expert knowledge is not required to configure
an effective fuzz campaign, and novices and experts alike can start
finding and analyzing vulnerabilities very quickly.

Some of the specific features BFF offers are:

  • Minimal initial configuration is required to start a
    fuzzing campaign
  • Minimal supervision of the fuzzing campaign is required,
    as BFF can automatically recover from many common problems
    that can interrupt fuzzing campaigns
  • Uniqueness determination through intelligent backtrace
    analysis
  • Automated test case minimization reduces the effort
    required to analyze results by distilling the test case to the
    minimal changes to the input data required to induce a
    specific crash
  • Online machine learning applied to fuzzing parameter and
    input file selection to improve the efficacy of the
    campaign
  • Distributed fuzzing support
  • Crash severity / exploitability triage





Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.
CIP Cyber Staff

CIP Cyber Staff

CIP Cyber Staff comprises CIP cybersecurity experts committed to delivering comprehensive information on critical infrastructure protection. The content covers diverse topics, equipping professionals to defend organizations and communities in an ever-evolving cyber landscape.

Most popular

Industrial Cybersecurity

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings

Related Articles

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings