Fuzz-testing XML parser

Question

I want a fuzz-test XML parser and wonder if there are any suitable fuzzers.
It would be nice to not only generate random garbage, but also take advantage of existing schema specifications such as XSD or DTD.

Answer 1

The following are some XML fusers that I accidentally encountered while searching a few months ago:

• untidy . This is not like active development with the latest update in 2007. (The project is no longer available on Sourceforge, for posterity see archive.org for partial content and packetstorm for download. It was added in Peach-1.0, but is no longer displayed in Peach-3.1 Community Edition.)
• Fuzzware Appears to have decent support for fuzzing based XSD.
• Peach . The Peach fuzzer project will help you generate valid XML files, but probably will not help if you want to confuse the parser instead of the application with the help of a parser. Of course, it’s worth a try, but be warned that creating a data model can be a cumbersome process if you don’t know about the various structures in XML. The related HotFuzz project is also worth mentioning here.
• JBroFuzz . It is quite actively developing. I could not find a tutorial describing its XML (and SOAP) capabilities. The fact that it can only be used as a fuzzing library can help you.
• Codenomicon Defensics for XML . This is a commercial fuzzer. Disclaimer I appreciated Defensics in the past and found it suitable for a variety of purposes. Only one XML parser can be confused using various methods - you can transfer its files created by fuzzer, or issue HTTP requests, etc. Keep in mind that you will need to use different approaches if you need to smooth your application, not the parser; Defensics will help you choose the different input classes that you want to use in the fuzz inputs so that you can target your parser or your application, or both.

Answer 2

It may be what you consider to be a “garbage generator,” but I will ask you to check it all.

Radamsa of the University of Oulu's Safe Programming Group is a free, versatile fuser. You can easily solve it. Give him some example files, and Radamsa generates fuzzed files for you.

Various included fusers can run from simple bit flip to complex structure study and confuse it.

The code can be found in Google Code .

Answer 3

American fuzzy lop may be a good choice here. It uses a genetic algorithm that will learn how to invoke new code paths in your program and come up with test cases that maximize reach.