Security Testing

News

Project 2 Results

Written on 23.02.24 by Leon Bettscheider

Dear students,

We have published the results of project 2. You can find your results and your passing status on your Personal Status page.

Note: If your results indicate "Legit Submission: 0", we will be in touch with you via e-mail shortly.

Congratulations to all who… Read more

Dear students,

We have published the results of project 2. You can find your results and your passing status on your Personal Status page.

Note: If your results indicate "Legit Submission: 0", we will be in touch with you via e-mail shortly.

Congratulations to all who passed!

Second chance for Test 1 Results

Written on 08.02.24 by José Antonio Zamudio Amaya

Dear all,

[If you had already passed the exam, you can ignore this message].

We have graded the second chance for Test 1. There are two possible results: PASS and FAIL. You can find the results on your Personal Status page as "Second Chance".

If your result is PASS: Congratulations! We… Read more

Dear all,

[If you had already passed the exam, you can ignore this message].

We have graded the second chance for Test 1. There are two possible results: PASS and FAIL. You can find the results on your Personal Status page as "Second Chance".

If your result is PASS: Congratulations! We do not need any further information.

If your result is FAIL, we have discovered that you have cheated, and you have failed Project 1.

Project 2 Fix

Written on 07.02.24 by Leon Bettscheider

Dear all,

There was an issue in the grammar that might have caused problems with oracle 4 and oracle 5.

Please download the latest revision (Version 2) of project 2 which fixes the issue.

Happy Fuzzing,

Leon

Exercise 12 Solution

Written on 05.02.24 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 12. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide… Read more

Dear all,

We have uploaded a sample solution for Exercise 12. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide individual feedback on your grading which you can find on your Personal Status or Submissions page.

[ACTION REQUIRED] Oral Exam Update

Written on 01.02.24 by Leon Bettscheider

Dear all,

This is an update to the previous announcement "Test Results".

If you belong to category 2, sign up for a time slot at https://dud-poll.inf.tu-dresden.de/sectest-ws2324-exam1/ but do not use your matriculation number but instead a pseudonym of your choice.

Then, send an… Read more

Dear all,

This is an update to the previous announcement "Test Results".

Then, send an e-mail to José and Leon using the following template:

---

Subject: [Security Testing] Pseudonym for Oral Exam
Body:

Pseudonym: <your pseudonym>
Name: <your full name here>

Matriculation number: <your matriculation number here>

---

We have deleted all previously submitted time slots. If you submitted your time slot already, please be sure to submit it again using a pseudonym.

Thanks for your understanding.

Test Results

Written on 01.02.24 by Leon Bettscheider

Dear all,

We have graded the test. There are two possible outcomes: PASS and FAIL. You can find the results on your Personal Status page.

If your result is PASS: Congratulations! We do not need any additional information from you.

If your result is FAIL, there are two possible… Read more

Dear all,

We have graded the test. There are two possible outcomes: PASS and FAIL. You can find the results on your Personal Status page.

If your result is PASS: Congratulations! We do not need any additional information from you.

If your result is FAIL, there are two possible reasons for this:

You did not attend the test on 24 January.
You did attend the test but failed.

If you belong to category 1: You must come to office 2.06 in the main CISPA building (Stuhlsatzenhaus) on Thursday, February 8 at 11:30 for a short oral exam. Allow one hour for this exam, i.e. you will need to stay until 12:30.

If you belong to category 2: You must come to office 2.06 in the main CISPA building (Stuhlsatzenhaus) on Thursday, February 8 between 14:00 and 18:00 for an in-depth oral exam (10 minutes). We ask you to provide your preferred time slot at https://dud-poll.inf.tu-dresden.de/sectest-ws2324-exam1/ until Sunday, February 4, 23:59. Only provide one time slot. If the time slot is already taken by another student, choose a different one. When selecting a time slot, please state your matriculation number in the field "Name".

For both category 1 and category 2: Bring your student ID card and your laptop with your Project 1 submission (alternatively: a print out of your Project 1 submission with line numbers).

Unexcused absences from the oral examination will result in failure of the course.

Only today: course evaluation

Written on 31.01.24 by Andreas Zeller

Dear all,

Today (and only today), you have the chance to evaluate the course. We're looking forward to your feedback!

Please follow this link: https://qualis.uni-saarland.de/eva/?l=147110&p=s0j3d9

Don't delay – fill this out today! Looking forward to see you, and best wishes,

Andreas… Read more

Dear all,

Today (and only today), you have the chance to evaluate the course. We're looking forward to your feedback!

Please follow this link: https://qualis.uni-saarland.de/eva/?l=147110&p=s0j3d9

Don't delay – fill this out today! Looking forward to see you, and best wishes,

Andreas Zeller

Exercise 11 Solution

Written on 29.01.24 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 11. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide… Read more

Dear all,

We have uploaded a sample solution for Exercise 11. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide individual feedback on your grading which you can find on your Personal Status or Submissions page.

Project 2

Written on 25.01.24 by Leon Bettscheider

Dear all,

We have released Project 2. You can find it under Information > Material.

This project is due on 18 February 2024 23:59.

Follow the instructions in sheet.pdf carefully.
The project must be solved alone.
Invalid submissions (e.g. verify.py reports a problem; not… Read more

Dear all,

We have released Project 2. You can find it under Information > Material.

This project is due on 18 February 2024 23:59.

Follow the instructions in sheet.pdf carefully.
The project must be solved alone.
Invalid submissions (e.g. verify.py reports a problem; not runnable) will result in 0 points.
Note that we cannot evaluate delayed submissions.

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Exercise 12

Written on 24.01.24 by Leon Bettscheider

Dear all,

We have released Exercise 12. You can find it under Information > Material. Please read the chapter Testing Web Applications and Testing Graphical User Interfaces for this exercise.

This exercise is due on 4 February 2024 23:59.

As a reminder, each exercise comes as a… Read more

Dear all,

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

Follow the instructions in sheet.pdf carefully.
The exercises must be solved alone.
Invalid submissions (i.e. verify.py reports a problem) will result in 0 points.
Note that we cannot evaluate delayed submissions.

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Test today at end of lecture

Written on 24.01.24 by Andreas Zeller

Dear all,

Today's test will be conducted at the _end of the lecture_. So in case you're currently late, do not worry – the test will not start before 17:00.

See you later -- Andreas Zeller

Exercise 10 Solution

Written on 22.01.24 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 10. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide… Read more

Dear all,

We have uploaded a sample solution for Exercise 10. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide individual feedback on your grading which you can find on your Personal Status or Submissions page.

Project 1 Results

Written on 18.01.24 by Leon Bettscheider

Dear students,

We have published the results for project 1. You can find your results and your passing status on your Personal Status page.

We repeated the measurements five times and used the maximum branch coverage achieved by your fuzzer in these five runs for grading, which is in your… Read more

Dear students,

We have published the results for project 1. You can find your results and your passing status on your Personal Status page.

We repeated the measurements five times and used the maximum branch coverage achieved by your fuzzer in these five runs for grading, which is in your favor.

Goals:

- Dimension 1: The goal branch coverage is 45%. Reaching at least 45% gives you 5/5 points in this dimension.

- Dimension 2: We introduced 30 bugs into sqlite. If your fuzzer could trigger at least 20 of them, you get 3/3 points.

- Dimension 3: We measured how many syntactically different inputs your fuzzer produces. If your fuzzer could generate at least 1000 syntactically different inputs, you get 2/2 points.

You pass the project if you meet the minimum passing criterion of 30% branch coverage or if you achieved 5/10 points in total.

Happy Fuzzing!

Lecture video for "Compiler testing" chapter now available

Written on 17.01.24 by Andreas Zeller

Dear all,

I hope you are safe and did not suffer from the extreme weather today. The topic for this week is compiler testing. The chapter is ready for you to study and now comes with a freshly recorded lecture video. Enjoy!

Best wishes -- Andreas Zeller

Exercise 11

Written on 17.01.24 by Leon Bettscheider

Dear all,

We have released Exercise 11. You can find it under Information > Material. Please read the chapter Testing Compilers for this exercise. It is recommended to review the chapter Fuzzing with Constraints as well as the ISLa language specification.

This exercise is due on 28… Read more

Dear all,

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

No in-presence meeting (and no test) tomorrow due to extreme weather

Written on 16.01.24 by Andreas Zeller

Dear all,

Given several extreme warnings about black ice, tomorrow's in-presence meeting is canceled. The written test on Project 1 will be delayed by one week.

The topic for this week is compiler testing. The chapter is ready for you to study; we will add a short introduction video… Read more

Dear all,

Given several extreme warnings about black ice, tomorrow's in-presence meeting is canceled. The written test on Project 1 will be delayed by one week.

The topic for this week is compiler testing. The chapter is ready for you to study; we will add a short introduction video soon.

Stay safe, everybody -- Andreas Zeller

Exercise 9 Solution

Written on 15.01.24 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 9. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide… Read more

Dear all,

We have uploaded a sample solution for Exercise 9. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide individual feedback on your grading which you can find on your Personal Status or Submissions page.

Exercise 10 Update

Written on 11.01.24 (last change on 11.01.24) by Leon Bettscheider

Dear all,

there was a file missing from Exercise 10. Please download the latest version of Exercise 10 which fixes this.

Happy Fuzzing!

Project 1 Test Next Week

Written on 11.01.24 by Leon Bettscheider

Dear all,

as announced in yesterday's lecture, there will be a short (5-10 minutes) written test on Project 1 next week.

The test will take place at the usual location (CISPA Lecture Hall at Stuhlsatzenhaus) during the next lecture (17 January 2024 16:15).

In this test, you will have to… Read more

Dear all,

as announced in yesterday's lecture, there will be a short (5-10 minutes) written test on Project 1 next week.

The test will take place at the usual location (CISPA Lecture Hall at Stuhlsatzenhaus) during the next lecture (17 January 2024 16:15).

In this test, you will have to answer a couple of simple questions about your implementation, e.g.: "How would you add <insert simple feature here> to your code? Where would you add it?"

The test won't be difficult. The purpose is to make sure that you are the author of your submitted project.

You have to bring the following things:

- Your Student ID Card

- Your Laptop with your Project 1 Code (alternatively: the printout of your Project 1 Code) such that you can look up details in your code.

Exercise 10

Written on 10.01.24 by Leon Bettscheider

Dear all,

We have released Exercise 10. You can find it under Information > Material. Please read the chapters Fuzzing Configurations and Fuzzing APIs for this exercise.

This exercise is due on 21 January 2024 23:59.

As a reminder, each exercise comes as a ZIP file that… Read more

Dear all,

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Exercise 8 Solution

Written on 08.01.24 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 8. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide… Read more

Dear all,

We have uploaded a sample solution for Exercise 8. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide individual feedback on your grading which you can find on your Personal Status or Submissions page.

Exercise 7 Solution

Written on 08.01.24 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 7. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide… Read more

Dear all,

We have uploaded a sample solution for Exercise 7. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide individual feedback on your grading which you can find on your Personal Status or Submissions page.

Exercise 6 Solution

Written on 08.01.24 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 6. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

Exercise 9

Written on 03.01.24 by Leon Bettscheider

Dear all,

We have released Exercise 9. You can find it under Information > Material. Please read the chapters Tracking Information Flow for this exercise.

This exercise is due on 14 January 2024 23:59.

As a reminder, each exercise comes as a ZIP file that… Read more

Dear all,

We have released Exercise 9. You can find it under Information > Material. Please read the chapters Tracking Information Flow for this exercise.

This exercise is due on 14 January 2024 23:59.

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Project 1 Deadline Extended Until January 5

Written on 02.01.24 by Leon Bettscheider

Dear all,

due to popular demand, we extend the deadline of Project 1. You must hand in the project until January 5 at 23:59.

Happy Fuzzing!

Exercise 8

Written on 20.12.23 by Leon Bettscheider

Dear all,

We have released Exercise 8. You can find it under Information > Material. Please read the chapters Greybox Fuzzing with Grammars for this exercise.

This exercise is due on 7 January 2024 23:59.

As a reminder, each exercise comes as a ZIP file that… Read more

Dear all,

We have released Exercise 8. You can find it under Information > Material. Please read the chapters Greybox Fuzzing with Grammars for this exercise.

This exercise is due on 7 January 2024 23:59.

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Exercise 4-2 Information

Written on 19.12.23 by Leon Bettscheider

Dear all,

if you think you got too few points for Exercise 4-2, drop me an email so I can re-check it. Please make sure to compare submission to our solution first. Include your reasoning on why you think you should have more points in your email.

Thanks,

Leon

Exercise 7

Written on 14.12.23 by José Antonio Zamudio Amaya

Dear students,

We have released Exercise 7. You can find it under Information > Material. Please read the chapters Mutation-Based Fuzzing and Greybox Fuzzing for this exercise.

This exercise is due on 31 December 2023 23:59.

As a reminder, each exercise comes as a ZIP file that… Read more

Dear students,

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Project 1 Time Limit

Written on 13.12.23 by Leon Bettscheider

Dear all,

I've uploaded a revision of the Project 1 PDF.

The only change is that we impose a hard execution time limit of **30 minutes** (one core only) on your fuzzer.

From the PDF:

**Your fuzzer will be stopped as soon as 100.000 inputs or 30 minutes of execution time… Read more

Dear all,

I've uploaded a revision of the Project 1 PDF.

The only change is that we impose a hard execution time limit of **30 minutes** (one core only) on your fuzzer.

From the PDF:

**Your fuzzer will be stopped as soon as 100.000 inputs or 30 minutes of execution time are reached.**

- Example 1: Your fuzzer generated only 20.000 inputs after 30 minutes. We will stop it after 30 minutes, and use the coverage achieved with these 20.000 inputs.

- Example 2: Your fuzzer generated 100.000 inputs after 10 minutes. We will use the coverage achieved with these 100.000 inputs.

Happy Fuzzing,

Leon

Askbot

Written on 12.12.23 by Leon Bettscheider

Dear all,

Askbot is the main communication channel for questions and remarks about the exercises and projects of this course. Please check Askbot regularly for any updates. If you post a questions, please make sure to give it an appropriate tag (e.g.: `exercise5-2`) so others can find… Read more

Dear all,

Thanks!

Leon

Exercise 5 Solution

Written on 11.12.23 by Leon Bettscheider

Dear all,

We have uploaded a sample solution for Exercise 5. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide… Read more

Dear all,

We have uploaded a sample solution for Exercise 5. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

We listened to your feedback:

Points of individual exercises are now displayed.
We now provide individual feedback on your grading which you can find on your Personal Status or Submissions page.

Exercise 6

Written on 07.12.23 by José Antonio Zamudio Amaya

Dear students,

We have released Exercise 6. You can find it under Information > Material. Please read the chapter Mining Input Grammars for this exercise.

This exercise is due on 17 December 2023 23:59.

As a reminder, each exercise comes as a ZIP file that… Read more

Dear students,

We have released Exercise 6. You can find it under Information > Material. Please read the chapter Mining Input Grammars for this exercise.

This exercise is due on 17 December 2023 23:59.

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Bug in `Coverage` output

Written on 06.12.23 by Andreas Zeller

Dear all,

In the coding demo this morning, I was confused by a feature in the Fuzzing Book Coverage class; printing out coverage would put a prefix # before covered lines rather than uncovered ones, as is the standard for coverage tools. This also was used inconsistently in the chapter. Only… Read more

Dear all,

I have now changed the code and documentation such that a # always marks uncovered code lines. However, this will only take effect in the next fuzzingbook package (1.2.2). So be aware of the issue when printing out Coverage objects.

Enjoy Python! -- Andreas Zeller

Exercise 4 Solution

Written on 04.12.23 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 4. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

Exercise 5

Written on 29.11.23 by Leon Bettscheider

Dear students,

We have released Exercise 5. You can find it under Information > Material. Please read the chapter Code Coverage for this exercise.

This exercise is due on 10 December 2023 23:59.

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf,… Read more

Dear students,

We have released Exercise 5. You can find it under Information > Material. Please read the chapter Code Coverage for this exercise.

This exercise is due on 10 December 2023 23:59.

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Exercise 3 Solution

Written on 27.11.23 by José Antonio Zamudio Amaya

Dear all,

We have uploaded a sample solution for Exercise 3. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page.

Exercise 4

Written on 23.11.23 by José Antonio Zamudio Amaya

Dear students,

We have released Exercise 4. You can find it under Information > Material. Please read the chapters Probabilistic Grammar Fuzzing and Fuzzing with Generators for this exercise.

This exercise is due on 3 December 2023 23:59.

As a reminder, each exercise comes as a… Read more

Dear students,

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Project 1

Written on 22.11.23 by Leon Bettscheider

Dear all,

We have released Project 1. You can find it under Information > Material.

This project is due on 02 January 2024 23:59.

Follow the instructions in sheet.pdf carefully.
The project must be solved alone.
Invalid submissions (e.g. verify.py reports a problem; not… Read more

Dear all,

We have released Project 1. You can find it under Information > Material.

This project is due on 02 January 2024 23:59.

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Update on fuzzing with probabilities

Written on 22.11.23 by Andreas Zeller

Hi everyone,

In today's lecture, I was puzzled to see that despite specifying a high probability for long numbers...

"<integer>": [("<digit><integer>", opts(prob=0.99)), "<digit>"],

... the fuzzer output would contain only one such long number, with the other <integer>s being single… Read more

Hi everyone,

In today's lecture, I was puzzled to see that despite specifying a high probability for long numbers...

"<integer>": [("<digit><integer>", opts(prob=0.99)), "<digit>"],

... the fuzzer output would contain only one such long number, with the other <integer>s being single digits.

It turns out that this is on purpose, as the fuzzer limits the expansion length. As soon as the number of nonterminals reaches max_nonterminals, the fuzzer expands the remaining nonterminals with the shortest possible expansion (in our case, <digit>), disregarding all probabilities. You can override this behavior by passing a keyword parameter max_nonterminals to the fuzzer constructor, say max_nonterminals=100. But then you also may get very long expansions, taking some time.

If you want to follow the decisions made by the fuzzer, add log=True as a keyword parameter to the fuzzer constructor, and you'll be able to follow every step.

Enjoy fuzzing – Andreas Zeller

Exercise 2 Solution

Written on 20.11.23 by Leon Bettscheider

Dear all,

We have uploaded a sample solution for Exercise 2. You can find it in the category Solutions under Information > Material.
You can find your points on your Personal Status page. We listened to your feedback: Points of individual exercises are now displayed.

Exercise 3

Written on 15.11.23 by José Antonio Zamudio Amaya

Dear students,

We have released Exercise 3. You can find it under Information > Material. Please read the chapters Efficient Grammar Fuzzing and Grammar Coverage for this exercise.

This exercise is due on 26 November 2023 23:59.

As a reminder, each exercise comes as a ZIP file… Read more

Dear students,

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Won't be at the Q&A/lecture on Wednesday

Written on 13.11.23 by Andreas Zeller

Dear all,

Due to a change of travel on short notice, I will not be able to join the Q&A/lecture this upcoming Wednesday. However:

For those of you coming for questions and answers, José and Leon, our valiant exercise runners, will be there to answer all your questions. You can ask questions… Read more

Dear all,

Due to a change of travel on short notice, I will not be able to join the Q&A/lecture this upcoming Wednesday. However:

For those of you coming for questions and answers, José and Leon, our valiant exercise runners, will be there to answer all your questions. You can ask questions on-site or post them on AskBot.
For those of you coming to see my live coding, there are nice (and arguably better) videos in the fuzzing book. For the upcoming exercises, please look at Grammar Coverage and Reducing Failure-Inducing Inputs.
For those of you joining in mainly for the improvisation, check out this compilation of Fuzzing Book bloopers. And yes, I did get a new laptop since. Enjoy!

Hope to see you in person soon again, and keep on fuzzing,

Andreas Zeller

Python fuzzingbook 1.2.1 update

Written on 13.11.23 by Andreas Zeller

Dear all,

We have released a new fuzzingbook Python package (version 1.2.1). This fixes a nasty bug that would accidentally fix the random seed, making all further random decisions deterministic (i.e., produce the same result every time). This is now fixed.

To update your fuzzingbook package,… Read more

Dear all,

To update your fuzzingbook package, run

$ pip install --upgrade fuzzingbook

If you want to keep your current fuzzingbook package but work around the bug, insert the following lines after importing from fuzzingbook.

import random
import time
random.seed(time.time())  # make random random again

Thanks a lot to the anonymous student who pointed out the issue!

Best -- Andreas Zeller

Register in LSF by November 30

Written on 13.11.23 by Andreas Zeller

Dear all,

Our examination office tells me all UdS students must register for the course in the UdS LSF system by November 30. (LSF course number is 147110). Only if you are registered in LSF on time will you be able to obtain credit points.

(Non-UdS students attending follow a different process… Read more

Dear all,

(Non-UdS students attending follow a different process and need not register in LSF.)

Don't delay, register today!

Andreas Zeller

Exercise 1 Solution

Written on 13.11.23 by Leon Bettscheider

Dear Students,

We have uploaded a sample solution for Exercise 1, you can find it in the category Solutions under Information > Material.
You can find your points for this exercise on your Personal Status page.

Exercise 2

Written on 08.11.23 by Leon Bettscheider

Dear students,

We have released Exercise 2. You can find it under Information > Material. Please read the chapter Fuzzing with Grammars for this exercise.

This exercise is due on 19 November 2023 23:59.

As a reminder, each exercise comes as a ZIP file that… Read more

Dear students,

We have released Exercise 2. You can find it under Information > Material. Please read the chapter Fuzzing with Grammars for this exercise.

This exercise is due on 19 November 2023 23:59.

As a reminder, each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

If you have any questions, please ask on Askbot.

Happy Fuzzing!

Exercise 0 Solution

Written on 06.11.23 by Leon Bettscheider

Dear Students,

We have uploaded a sample solution for Exercise 0, you can find it in the category Solutions under Information > Material.
You can find your points for this exercise on your Personal Status page.

Exercise 0 + Exercise 1

Written on 25.10.23 by Leon Bettscheider

Dear Students,

We have published Exercise 0 and Exercise 1. You can find them at Information > Material. Please read the FuzzingBook chapters Introduction to Software Testing and Fuzzing: Breaking Things with Random Inputs to prepare for these exercises.

Exercise 0 is due on 5 November 2023… Read more

Dear Students,

Each exercise comes as a ZIP file that contains:

sheet.pdf, listing the tasks
a number of Python/Jupyter Notebook/Text files for you to implement or extend
verify.py, a script that checks whether your submission is valid in a sense that all required files and functions are included

We ask you to submit your solutions as a ZIP file via the CMS on your Personal Status page.

Happy Fuzzing!

Welcome to the "Security Testing" course!

Written on 25.10.23 by Leon Bettscheider

Welcome to the "Security Testing" course!

We're currently setting up the infrastructure for the course, and will have a dedicated AskBot and Mattermost chat available for you by next Monday.
Via these channels, you can ask questions about the current exercises, and discuss fuzzing with your fellow… Read more

The LSF registration will be open by next week.

Show all

Security Testing

Software has bugs, and catching bugs can involve lots of effort. This course addresses this problem by automating software testing, specifically by generating tests automatically. Recent years have seen the development of novel techniques that lead to dramatic improvements in test generation and software testing. In this course, we explore these techniques – in theory and in code.

Course Organization

Every week, you will be provided with Jupyter Notebooks that teach a particular topic and illustrate it using plenty of runnable Python code. These notebooks come from The Fuzzing Book, a textbook on how to generate software tests written by yours truly.

In the notebook, you can edit the code as you like, run your own experiments, and re-use and extend the code to your liking. Your task will be to use these techniques (and their code) to build a series of fuzzers (i.e. test generators) that find bugs in a number of challenging settings.

Meetings

This course uses the "inverted classroom" principle – you learn at home, and discuss issues with your instructor. In our weekly meeting, we use the gathering in the lecture hall to

discuss the assignment of last week
discuss the assignment of next week
discuss ongoing projects as well as general questions.

These meetings come with live coding, so we can explore ideas right on the go.

Projects

During this course, you apply the techniques learned in weekly exercises and two projects which form your coursework. Projects are graded for effectiveness, efficiency, elegance, and creativity. Projects offer special challenges which allow you to gain bonus points. Note that we will conduct tests in order to verify that you are the sole author of your project.

Exercises

Every week, you get a simple exercise assignment covering the material of the last lecture. Performance in these exercises will make 33% of the final grade. There is no final exam, but we may conduct tests in order to verify that you are the sole author of your assignment.

Requirements

Advanced programming skills (such as obtained after two years of successfully studying CS) are required. Knowledge in Python is useful, but can easily be acquired along the course.

Passing Criteria and Grading

To pass this course, you need to have

at least 50% of the points in each of the projects, and
at least 50% of the total exercise points.

Your final grade is determined by 66% projects and 33% exercises (see above).

Lecture Plan

The course is organized as "inverted classroom": Every week, we discuss a chapter of the book, which will be supplied with an introduction video; we meet once a week to discuss the material, the associated exercises, and the ongoing projects.

The sequence of chapters is different from the book; in order to synchronize with the projects, we first discuss black-box techniques, then white-box techniques, and then domain-specific approaches.

2023-10-25: Introduction to the course • Introduction to Software Testing
2023-11-01: – No lecture (All Saints' Day) –
2023-11-08: Introduction to Fuzzing
2023-11-15: Fuzzing with Grammars • Efficient Grammar Fuzzing
2023-11-22: Grammar Coverage • Reducing Failure-Inducing Inputs
2023-11-29: Probabilistic Grammar Fuzzing (makes use of Parsing Inputs) • Fuzzing with Generators
2023-12-06: Code Coverage
2023-12-13: Mining Input Grammars
2023-12-20: Fuzzing with Constraints and exercises in Mutation-Based Fuzzing • Greybox Fuzzing • Greybox Fuzzing With Grammars
2024-01-03: – No lecture (Group retreat) –
2024-01-10: Fuzzing APIs • Fuzzing Configurations
2024-01-17: Testing Compilers
2024-01-24: Testing Web Applications
2024-01-31: Testing Graphical User Interfaces
2024-02-07: Current Trends in Fuzzing Research

The lecture plan may be subject to changes; these will be announced in time.

Date, Time, Location

CISPA Stuhlsatzenhaus, lecture hall 0.05, every Wednesday 16:15–17:45
13 lectures
6 Credit Points