GitLab Fuzzing, 23 Jun 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Fuzz Testing Group Meeting - 2020-06-23

Description

Weekly Fuzz Testing group meeting

A

So I've got the first agenda item, so I just wanted to share some of the initial feedback we've gotten from sales in the marketing team. Now that we've publicly announced the acquisition we started talking to the sales and the field staff, you know about what this means a lot of enthusiasm around it. People seem really excited about bringing new capabilities.

A

New technology to customers, you'll most likely see a lot of new faces popping in the buzzing slack channel, so those are going to be people that have seen the announcements and have questions, and it's, in my opinion, really great that we are seeing the enthusiasm we are because you know it's gonna be great. Once we have version one, we can start engaging with customers and giving it to them. I think.

B

This came up on one of the calls about whether there'd be a new gitlab tier I. Don't know if there's been any other discussion of that or whether that was just kind of someone's someone's idea. I.

A

Have not seen anything concrete in terms of a new tier I think that was probably just an idea or a discussion. Okay,.

B

A

Nothing in relation to fuzz testing now and James. You've got the next one yeah.

C

Tomorrow, I'm doing a walkthrough of PI test, Auto Explorer, it was a proof-of-concept plug-in to PI test I, wrote that and use existing Python or PI test unit tests to determine basically starting points for fuzzing and other exploration methods right and the other ones in this case being SMT solving but yeah. So this will be a walkthrough of that proof of concept, and it is something that I am building on and I will be applying similar concepts to go and Ruby.

C

Oh I've got the next one too, so I have been working on some dog fooding and or getting that set up, get lap runner. It's a go project generally, if I understand or my current understanding of github runner is that it mm-hmm it has its own API that it uses. That's how you talk to it and so I realize it may work well with API fuzzing, as well as coverage fuzzing to fuzz the mmm kind of inner aspects quickly of github runner.

C

We could skip the API part and jump straight to the commands that it does based off of the requests it receives, but then we could also pose the API I haven't mmm I, don't have a proof of concept working on that one yet, but I'm still doing research and trying to figure out the best way to hook into it and the fuzzing get ibid animal I started on this one I'm further along on it, because I personally ran into an issue with this and I already had code set up to start testing it, but it is mmm working.

C

I need to put it into a CI job. Oh yeah I have Ruby code that uses some Russ code, that I wrote to generate data from a grammar and then it tests the here I, can link to the actual file it tests the gamal parsing, to make.

C

Let's see it's not expecting memory, corruption, errors, it tests, the Gama parsing for any errors that aren't raised as a validation error and that's what would cause a 500 server error and that's what I had run into a few times and the ticket there is for the one that I've found and it is I, haven't fully implemented. The grammar for get lab, see I thought you animal. So it's not fuzzing all the features, but most of it is there and I'm going to show here. It is okay.

C

If you're curious. This is where it actually calls into the llamo parser and that's about it.

A

Recall we found a bug already.

C

Yeah I I wasn't sure what to expect- and this is when I ran into manually. So it wasn't a new new one. I ran into this just trying to use get labs, yeah well and yeah, but it was reassuring, though, that the fuzzer found it and I had it a test case minimization. So we've got a super minimal test case for the team.

D

I mean so I see that he wrote it and Ross and maybe I missed it. How did he linked with the parsing library or is it in some kind of her PC or.

C

Okay, yeah so D. Let's see I made a ruby gem that loads mm. How do I stated all right, so I made a ruby gem that loads a rust library. So it's got it's a native Ruby extension I'm that uses my grammar fuzzing code. So the grammar fuzzer is something that I've been doing for fun and I wrote it in rust and so I already had it and it's fast and so I use it but yeah. So the code that I've linked that yama fossa RB it loads.

C

The mm ruby gem that I created with the native extension and then calls functions on that to generate the data and.

D

I mean like where is the okay like: where is the get lab code? Okay, so the github code essentially is located and the yama father's old, RB right? Oh the.

C

Good lab code that is getting the fuzz yeah that is found in get lab, so I haven't added much documentation to this at all. It's you've run this by having a full set up instance of get lab like with the get by a development yeah as what the get lab SDK.

C

So no, the GDK get lab development kit yeah once that's up and running. If you can run normal unit tests on that project, then you can run this. It needs a database and it needs a few other things. So it's not quite that complicated and you've run it or it's not that simple you've run it using the rails, runner command, and that runs this script within the rails context with all of the dependencies loaded, yeah.

D

I I thought it's a like: it's a grammar fuzzer, it's not it's not coverage, guidance right and just trying random grammar yeah.

C

That was my grammar: okay, okay, now I yeah.

B

A

The words, oh all,.

B

The results feminists are just being stored as as your own artifacts they're, not going into a library that would put them as a JSON file. For us, oh yeah,.

C

Right now, this is just running locally on my machine right.

B

C

Haven't set it up to run and get lab yet, and that's kind of the next step I've been working on trying to boost performance a little bit but really I'm, focusing now on just finishing the grammar making sure it's able to generate gamal. That hits all the features yeah and then I'll put it in github. So I'll have like a scheduled jobs that runs on the latest, get live every night or something yeah.

B

Cuz I think from what we're trying to do is is figuring out how much of this could get codified into like the CLI tool right or if rashes or any of this errors can get into our JSON file. That can then show up on the dashboard right so that, ideally, your the code, that you're writing is just minimal code and then all the other infrastructure is what we want get lab to handle so that you know you've got a fraction of the amount of work to actually implement this type of thing. Yeah.

C

And it's a it is an interesting dogfooding example and I haven't touched it since oh mid last week, besides pushing up the code this morning, the well and the reason for that is I. Don't think that it's use case fits in with our MVC, because it is not directly API fuzzing. It's not the feedback or coverage driven fuzzing, where we already know how to parse the output and generate the JSON file like it's definitely useful, but it's not plug-and-play from a user perspective. Yeah.

D

I think I think it will be quite complex to four before please for MBC to do doc, put it into our CLI. Probably it will be best like for dogfooding writing like a super standard leap, father or gafas targets, so this will be the best. The best way that.

C

Being said, I could make it generate a JSON file base, ons, straightforward and if it matches then it'll show up in the dashboard. So yeah.

D

Yeah I mean it will work just uh yeah. Of course, I mean we can also implement do that in the future. I just think that for the embassy, probably like a standard D fuzzer because I already tested it with live buzzer, but later we can also integrate it with what this with the grammar parser. As long as it's output JSON, it shouldn't work essentially yeah.

C

Yeah exactly so, you have right now. I am focusing more on github Runner and trying to figure out the best way for us to do that one. But this one was pretty quick to stand up. Alright, that's it very cool.

B

So the next one I had was I know there was some discussion on naming from last week haven't caught up on all the issues. Just one see we're naming our variables and so on and so forth, and the repos based on API, fuzzing and coverage guided so I just wanted to see. If there's any direction change or whether would she keep moving ahead and I think Sam, you said to keep moving ahead.

A

Yeah, let's keep on this path for now, if we need to rediscovering new stuff into the product in the future, we can certainly talk about it, but for now, let's keep on these two okay.

B

Yeah I just wanted to confirm that, because it's certainly a lot easier to change names now.

A

Yeah then definitely.

B

Doing it later, but if we're good we'll keep it forward and then the next item you're getting I just want to make sure I. Think there's some discussion on slack about the demo for the customer advisory board want to see. If you have any questions for that, if you need any additional information from Sam or from anyone else, yeah.

D

So actually the demo is ready. I didn't record it yet because I thought that it might be worth first going through the demo live, so we can get some comments and then I'll do a recording. So maybe we can do that either now or if we have time or tomorrow. We can do that now. I think if we have time, but we can also, let's see if someone else has questions and then we will jump into the demo. Maybe.

B

Yeah, that sounds great.

B

And then James did you see I think you had the last item right here, just a plan to sync up with Mike yep.

C

Exactly this is on my radar too. It's something that was it last week. There was something else that came up where I said: I could help set up the dogfooding for API fuzzing and I. Haven't synced up with you yet Mike, so yeah I'll do that today, sync up and figure out what we need to do to get that going.

B

Perfect sounds good, any any other items to go over. If not, we can jump into a demo.

B

E

Yeah the video needs to.

B

Drop off feel free to but we'll jump into the demo cool.

D

So so this is so Paul Sciarra share my screen.

D

B

D

This is the first demo off of a merger quest that is currently being reviewed, so.

B

So you're getting before you keep going I, don't know if it's possible to lower your screen resolution. I can see it just fine, but for the recording, when you have that really high resolution, it's hard to say I think.

D

B

A quick thing to do.

D

Let's try um or can I just zoom in maybe yeah.

B

I know yet that that I think it should work for work, okay, easier solution, yeah.

D

D

Yeah, so, okay, so this is. This is a demo of continuous fuzzing integration, and this is on my local instance with an energy quest that is currently being reviewed.

D

Okay, yeah nevermind Allah put a link to the merge request later so here we have github CIO Channel.

D

Sometimes, okay, so how it looks like is that we we have to include a template coverage. We added the new template to the base, github Ruby back-end. It's called coverage, fuzzing gitlab, and what we need to do in order to essentially to run our first tests in the CI is, to add, add a new stage first stage and for each first target we need to create a new first target or first function. It's the same thing.

D

So for each step, we need to create step for that fast function which, and it will extend fast, something that's called fuzz bass, and this is essentially included in the parent template. Okay, we have I already uploaded a handy, docker image, so we will have handy docker images under gitlab cough as those they want to include. They want to include any they want to include our CLI. They will just include like our CLI will be downloaded and in real time at least for now, we can discuss it later.

D

I have some I have good reasons for that, but the Handy images are to have like to have built the father's built-in, because it takes a lot of steps to.

D

Usually it takes a lot of steps to install the fuzzers like installing LLVM or installing lib father inside wiggling, like it takes a lot of a lot of steps. So I here I have going with nofas already available and in the script. Those are standards, standard steps that you can find in the office documentation, and then we will run the user will have to do to run essentially the first target with with this graphics.

D

Maybe I can change it. Just this prefix, yeah, I, think I think it's not dated as actually it's also checks the the environment like environment variables as well. So so.

B

D

Is how the yama will look like for one foster, get weird.

B

To see where to see I installed so.

D

Yeah, so the coverage fuzzing is downloading this because.

B

D

The reason for that is that CLI is, is just one binary, one small go binary and pushing like we will have. Probably we will have a lot of handy documents that contains the likely father or contained Godfather's, contains a failed and creating all those docker images every time we're creating you and you release just that consumes more more more time and the resources. But we can do that as well like we can have them yeah.

B

Binary is pretty small right, yeah.

D

It is so okay, so now, if we will go to see ICD well, we have a fuzzing session, so we can see this is commit to master, and this is a merge request.

D

So here I just pushed something to you to master and we have let's go to this pipeline yeah, so we have a fuzzy stage and we have- and we have this function like this step. This is a step for our first function and we can see that we can see all the logs, of course, just like in any other step, and we can see the leap, buzzer rafa's and with fuzzy targets running here and essentially crashing finding the new crash.

D

So currently all the crashes and the test cases that the father general generated are can be found and downloaded here. Just like I showed in the previous demo, I also save a copy of the buzzer. We can, we can decide if you want to keep it or not. I thought it will be good good way to keep it because then the user will be able to also to reproduce it locally. This is the CLI, because we we say like we save everything, including the father. So here are the crashes.

D

Here's the corpus yeah and if we go to.

B

Sorry, and so, if it finds a crash, it fails. The job is that correct, yep.

D

Yeah one second, oh yeah, that jobs in the pipeline is a bit confusing. So so here we have the security. Oh okay, sorry.

D

Yeah, so here we have the security dashboard in the pipeline, and so we have a new a new report die now we have coverage passing report. So obviously now we see the the crash itself here so like this now this page also forces the our new JSON file.

D

There is some more code that I need to add to our CLI to categorize the civility correct, I didn't port it yet from from posit, but uh but it does, it does first, the index out of range like this is the the arrow that offers five finds. So we can see.

F

D

Leap, buzzer hi, its coverage fuzzing severity, currently it's unknown, but it will be updated here we have the like.

D

It's called the state, but essentially this is like a stack trace without random addresses for the crash, so the crash really happened in here in parts complex funk. We can also see that see that in the in the logs yeah, also, if we, if we find more like more data like I, like I, showed them the screenshots in the merge request, so there will be also address available and I think yeah, address and type and type of the I think there is about here because should also show like index out of range here.

D

But for some reason now, I say that in thousand it's only showed shows it here for some strange reason, but it we also also should see that like vulnerability type, which is index out of range yeah. So this is the current merger quest we still are not seeing like from. Probably it will be in the next merge request, because we should also see this here and the security dashboard I guess because currently, in the merge request, I'm only parsing the data from the JSON and I'm, not saving it the database.

D

It might be the reason so.

B

The dashboard is only gonna show what's on the master branch, so so.

D

No mutton but I ran it on the master branch I mean here. This is this: is the master branch and.

D

If I'm going to configuration, then I'll also see there. Probably there is some small bug here, but here it's a this is like the coverage, fuzzing type, which is currently enabled and yeah, and but it's not it's not showing in the security dashboard, because I think it's not saving it into the database. I assume.

D

Yeah so so maybe ask questions and then I'll show ya.

B

So one question in terms of functionality, so Sam I saw that in this a it fails the job, but it allows failed job, I. Think all the other security analyzers always pass. I, don't know if the. If what we have here is accurate or whether we want to set the job status to pass.

A

Really the the key point is: we won't be able to fail the pipeline because we don't want to feel pipelines because the security in terms of the actual job status itself, I, would say we should be consistent with what all of our other scanners are doing. So, if they're passing a, we can do the same thing.

B

D

B

Want to set the exit status code for that job to be successful, even if you find a crash. So all we're saying is that the the fuzzer ran successfully yeah.

D

B

The status code will be it'll, be a zero status code, so everything's fine and then we'll still show security results. We're not saying that anything failed yeah.

D

Yeah, fine, maybe sure.

A

Yeah yeah, so a couple pieces of feedback on the demo. I think this looks really good in terms of what we can show it. The cab for this is the direction we're going in, even though BMR and everything is still in process.

A

One suggestion for when you're reviewing the CI file the amal, I would either say speak to it or add a comment to describe what that parse complex is in there or review the repository as part of the demo walkthrough, because, as an audience member, it might not be immediately clear. That's the code of the application itself, so that would be something that's good to highlight as part of the demo walkthrough yeah.

D

Yeah, I think so as well. I just I just I think everyone here were in the preview in the previous demo. So I walked through the parts complex but yeah. It's a it's a good point. I'll I'll. Add it to to the video.

A

Yeah and also for the security dashboard for the project for the purposes of the demo, I mean I, think showing just what you did with the modal dialog is probably fine to show like this is the direction we're going in because really the the cab. This is a preview, so, even if it's not in the project dashboard, yet that's, ok and it can be omitted if you want to record it before you're done. Implementing that yeah.

A

Get folks excited I think when they see see this.

C

I have a couple questions and sure like I'm. Not mmm let's see me because I don't know, I think I, don't know the answers, these questions, because I've probably missed something and some of the issues and merge requests that are going on yeah, so the crash state is that always the back-trace I can't remember what we add at what field we added to the database like I thought we I remember. We had a discussion about specifically just calling a back trace or stacktrace yeah.

D

D

Yes, so the fresh state is, is essentially back like a back trace without the randomized addresses I I. Don't remember the discussion and changing this name, but we can change change it. The database Samar I'm, not sure we will like we will need it, at least for now, because everything fits quite quite good into the current, like design and architecture and database of like the current security parsers and features.

D

So this M R doesn't he it doesn't use any like features of the first of the amar that I opened up like a few weeks ago, when I just joined, ah-ah-choo and I'm, some not I, wasn't aware.

D

I still, I wasn't familiar with with the you know, with that code base and architecture, so I just added AHA the database schema but- and it was reviewed for a lot of weeks and it's still beauty, but now it's on on hold so because, because actually this, this, mr already, is doing a lot of the work that yes, because the this, mr should be merged first anyway, and then we can decide if we need a like you new.

C

D

The database nice.

C

My second I didn't have time to I, didn't write it up while we were talking. But my second question is: mmm is there a way to add a hash of the input somewhere like even in the crash State just so that you can link that specific crash to one of the crash files?

C

Even if it's manually.

D

Was the hash of the input so I think?

D

D

Like the police, yes so I can I mean, maybe maybe it's this one I'm not sure I. Think.

C

It's where it's.

D

Just a single rhythm, oh yeah,.

B

James you're talking about having that value in the in the vulnerability as we're calling him ya.

C

B

C

We've got a discussion or a ticket elsewhere, so you can download it directly, but since that's definitely not going to be in the MVC, even just having the hash of the input so that you could manually look it up somewhere. Yeah would be very useful. Yeah.

D

C

D

A it's a good point: I think we need to to add it, maybe not too dissimilar, because this, mr is big already and with like front end games and back in teams and and then once we have. This, mr I think it will be very easy to to add a new field and it will be reviewed quickly. So I I, don't worry about. Where we'll be the right place to put this issue but yeah sure yeah.

B

I mean I think you know to reproduce this issue, you look at the web console and then you can download all the artifacts, which is great. That allows, allows you to get to the same state I. Think eventually, what we want to be is looking at the screen this this page right here. That would be nice.

B

If that's all the information, you need to reproduce this this bug, so it would have the input and all that all the rest that way yeah so just don't, have to go and download all these other artifacts and try to go through it. That way,.

A

So, are we talking about not putting the download button? There, then. Is that what we're talking about right now or are we talking about a difference for downloading I.

B

Don't think we're we don't want to get rid of anything I. Think the question is: what is our end state look like post, MD, say.

C

To me, the in state, you have would be the download button and then just having the ID of the input somewhere within the vulnerability modal. Would let you look it up manually and downloaded that's. What I was thinking is that what you were talking about says.

B

Yeah, so what I can see happening on here is you know you actually have the input value out, put it on the screen and then potentially, for example, you could have direct links in here for the corpus or for any of the other information visit, because you know if, if you go onto the screen like this is great, but now you have to close this, you have to go to the web console you have to download the corpus you have to download all those artifacts and then you're not really even sure how you go from all those artifacts to what we're seeing on screen, and so we should be able to connect those dots a little bit faster.

C

It may be hard to then put value directly. Let's see.

F

What it looks like anyway,.

C

It could be binary data yeah. Actually, we could link directly to a file within a build artifact for the pipeline. We.

B

Could do that right now we don't need any new.

C

Features for that yeah.

B

C

That that's probably the easiest way right now: yeah the.

B

One thing to be careful of with that is, if we I think all that data that we see in the modal will get persistent to the database and so any of the data persisted to the database. If you have links, we just have to be careful if they're linking over to assets because there's or artifacts, because there's artifacts may expire, that's right.

F

To be clear for NVC, we will show this model when you're not.

B

Yeah I would I'd say yes, yeah.

D

Because it's already in the request.

B

D

It's really and.

F

We have a new kind of instant page right, I'm, not sure like it's a lab or not. Did we consider that, like lots of modal window, where, like I know, that's with the first class vulnerability and those staff are training to a new page right.

B

Right so I'm not sure if everyone's familiar with what commands talking about, and so, if you go to the security, dashboard, you've got a list of vulnerabilities and then, when you click on a boner ability to take you to a dedicated page for that vulnerability, yeah I think we have to see where this ends up. Once we get this into the security dashboard, look I think the next step would be.

B

You know, figuring out why how to get this data persist into the database, and then it's just what comes out of the box with that instance page likely. It's not gonna have any of these fields that these custom fields that we just saw, which was a crash date and I, think you have one or two other fields so.

F

The incident page won't be on the pipeline area, so the pipeline will still have this. Modern window itself means a page.

B

I'm, not sure I think the answer is yes.

B

So this pipeline, so this data will need to get flowed through to the security dashboard.

F

Yeah I mean that like for not only for fighting but for all those scanners and when they are showing in the lease of this pipeline page and when you click on that, the detail will still keep in the model window instead of like also replacing this modal window is instant page there's no.

B

F

Like yeah, this is ongoing. I.

B

Don't know like I, don't know the direction of the modal verse, the the individual page, I, don't know how what right thread insights is doing on that area.

B

Sam. Do you know if there's a move to get rid of the modal or so.

A

B

A

And the pipeline is still the same for all the scanners, its wins promoted to a vulnerability. It becomes a standalone vulnerability at that point makes sense it's like. If you click the the modal there. Does it have a promote to vulnerability, option or well. I guess create issue yeah.

B

A

B

An issue is different than a vulnerable.

A

So this is not integrated with scandal and vulnerabilities. It looks like them is that correct.

D

Yeah I guess so I mean we can yeah I, don't know what I mean I, don't know exactly what standalone vulnerabilities, but I mean I. Think I saw it in some of the discussions but uh yeah. This is why we are not saying this here and this. What we'll have to add in in the next request and then I think it will be easier to maybe do this to discuss what exactly we want to do with put the handle on vulnerability.

A

Okay, um if we can go back actually I'm I'm, sorry I still don't understand the direct answer on so, if we're talking about pulling the modal into MVC, which was not in the original requirements, this is in addition to that download artifacts button that we agreed on in the initial designs correct. This is not a replacement of yeah.

F

A

Like keep asking that I just wanted to be clear, I was not making an assumption. Yes,.

B

D

B

Am can you pull that page up the design just to make sure we're all talking about the same thing.

A

B

You can maybe send that to you getting anything, pull it up. Yeah.

A

Since he's already got the screenshare open.

B

Yeah so yeah, so Sam I apologist. The benefit to this is this: almost all of this functionality came out of the box. Worse mm-hm.

A

Yeah now I wasn't sure if this was just part of the demo or this what this was and replacement. Oh I wanted.

B

To clear yeah now the goal was the goal was as soon as we got the crashes into our JSON format. What we're seeing come most of it comes out of the box, and there were some tweaks that were yeah.

D

The only thing is that so I saw I saw the download button that we discussed but I'm not sure who should add this button, because because this is a new functionality, some I'm not familiar with the front-end code base. I mean I, can try and find where to add it, but I'm, not sure who, who should add this modern and then then we should implement the backend somehow to download that report, or maybe the report actually is already rate available, so I think it's only in front and world yeah.

D

So so we need to talk to someone from the front-end team to to implement that for the MVC as far as I understand or if it is my my job so I know.

B

It to know, and.

C

D

Then and then I need to figure out how to to add this bottom yeah yeah.

B

And- and you and I can talk about this I think Fernando is on this issue, so he's a front-end engineer that can work with you to get it into the front end yeah.

D

I think, actually he, yes, he wasn't. The cola I think he actually awesome that messaged me yeah.

A

D

B

D

Yeah so don't know, I, remember: okay, yeah.

B

So he can, he can add it on the front end and then, if there's, if it's not available from an endpoint today, that's something you'll need to add to the backend. Okay.

D

Yeah so yeah what should I open here so.

B

Just just to confirm, if you click on that first, what Sam's talking about is this download report so yeah our front-end team will add that and then there didn't need to hit an endpoint or get that data from from from the backend which you'll need to implement correct.

A

And I think that button I don't think there is a new back-end because we're just linking to the artifacts of the job yeah that URL you went to with the browse. We can just put the bundle link to that I.

D

Not I think, yes, sorry, I also, don't think there is any back in there, but it's also not in the in the artifact. It's in some different place for, like the reports are stored, because here because we are like it's not an artifact, it's a report, every port type. So we don't see the report here, because this is just the artifacts but like there is geo coverage. Fuzzing report up right.

B

And- and it's just this just got added: if you go to the pipeline view,.

B

D

So here yeah, you can download here, but actually maybe maybe I missed something in the merger quest because because there I can download it. But of course, of course, it's available because we can see that the data is parsed. The.

B

This is a this is kind of a quirk with the way that it's set up so artifacts are, like you, said, they're, just files that get downloaded at the end of a job and then, if you're, using the report, syntax, which is what you have yeah warts, are not part of the artifact collection yeah.

B

If you want them as part of the artifact collection, you can actually just say you know report, you know, report name and then you say artifacts path and then give it the same file, name and it'll show up in the artifacts, but.

A

B

Actually duplicates the file, it's gonna write it twice so, okay, the code that you're seeing with the little download button here, that's what you will want to over to the other page.

B

Or the option, as we duplicate that file and added to the artifacts.

D

Okay, we can. We can look into this.

B

Yeah yeah, but I think we're probably better off linking to where this button is right here. Yeah that way we're not duplicating the file and then if people want all the artifacts, they can get it through that other navigation.

A

So we will be linking to those job artifacts, not the report itself, though correct, because the JSON report won't have all the pieces of info in it. It's that folder that has all the the crashes in the corpus correct. Oh.

D

Yeah, that's right! That's a good point yeah! So we'll have to link to the to the zip that contains up everything there. Yes right, okay, but.

B

If we link to that, it won't have the JSON document, but.

D

We can, we can do maybe we can duplicate it. Okay,.

A

B

We do a Suns.

A

That useful for end-users anyways, though, because they're gonna see all the results in the modal and they can look at it, and then they can correlate that with the the files the the crashes and the corpus documents, I think are: what's gonna be more useful to them. If we have to pick one or the other yeah.

D

But but I think we don't, we don't have we can we can duplicate, I, don't think it's an issue. Yeah.

B

Duplicating it is a one line, change that yeah Malaya. So if we duplicate that report, then we can just link to all the artifacts. If we want to do that.

A

B

Good without so Sam you're good, linking to all the artifacts instead of just the JSON okay, yeah.

A

Thank you for the clarification appreciate.

B

Tamera did that answer your question. Yeah.

F

Add a different question, but I just come from. There is Andy, that's like for the pipeline page. They will keep, have the more that window for a while and for the dashboard. We will have the instant page. Okay.

B

F

I do have another question so from from the example that I got, there is a piece of data called tree. Spec snippet. Is that something important that we want to show it to you? There are not important information.

D

Which, which example I.

F

Think you give me example that I can download. You know like one of the JSON file called trees, a stack trace, snippet yeah.

D

F

Huge long day that is important that we want to show.

D

I'm not sure if we want to show it in the module. Maybe it's it's a bit big I, don't know because.

E

D

It's available: maybe we just want to link to the to the logs, where you can see all the data so.

F

Like it is important for user to um I.

D

Don't know sound, what do you think if.

F

It's important we can think of a way to display it like in the future. Not me and me see.

E

Seems like it's the only information that a user has in front of them to distinguish different between different issues like if I was sorting through a bunch of these fuzzing results. I feel like for me would be useful to see that stack trace, so I can understand without having to download and then open the download and look at all the information a little bit of. What's going on.

C

But we have the the crashed state right now, which is the stack trace right. The.

D

Crash tape is a stripped-down version of the stack trace because in just like the last three functions, usually I was.

C

Gonna say that it did look pretty small, because.

D

This is this is for helping for the backend to compare crashes.

C

A

C

F

C

Knew that okay.

F

So there are other three data that I didn't see. There are some question like crash address crash type. Are those two are also useful for the user to see.

D

Yes, yeah so for some reason in corn demo, it was amazing I'm, not sure why he.

E

Was the title of the modal box yeah.

D

Maybe yeah all right. So if we go here in the screenshot, you can see ya know I, but.

C

Actually, here we can also.

D

Have we have this in the description, so this is like the type currently, and here we have the crash address as well.

F

Description is crash type.

D

Yeah the description is crash, type and I. Think it's like adhering to the current way of how we show vulnerability is because I try to click on various soft and awesome allure, abilities and, like the type of the vulnerability, is of the title.

F

We won't godlike for other scanners, but that's like some kind of worse description like what it is. So we're going to get that type of data.

A

Yeah almost see this turning into, if we want to do this at some point, the description being more freeform text about what the specific type of fuzzy result means. You know if it's a heap overflow. That means that we should be pointing to malloc and calloc type calls and explaining that to users. It wouldn't necessarily be application. Specific context necessarily I could see it be more as describing the the type of issue that fuzzing found, because the individual fuzzing results themselves are going to be so specific.

A

We won't be able and I, don't think to provide much more specific details. There.

E

A

When we talk to our.

E

Doc's that have a really good description of investigation and yeah.

A

F

Then I'm thinking maybe just cover the crash tab instead of description, it's more useful for the user, so.

D

F

D

Probably I guess we should we should do that. Probably just was yeah last.

F

Question so I'm playing around to fit those data into the instant page and instant page have like titles, and one of them is location, so only crash address belongs to location, right or even a crash address. It's not location.

D

Crush the rest is also location area.

F

If there's something else, also location, I,.

D

Think the location currently is how, in the last request, is fresh. You you can see, can also sense and I'll send the word request.

C

D

C

Be the same thing probably talking about one location and that's the crash location I mean.

D

The location usually is like yeah, so one second, you can see in the yeah, there is I, think yeah.

C

So it's a crash addressed.

D

Fresh stage and crash type.

D

Here this is this is the like location is, is a keyword in the common schema and every every security parcel. Every security feature implements the like his look. What he uses for, defining, let's say a vulnerability like a yeah, a location of the vulnerability, let's say so.

D

The father cover it on the coverage. Guided I'm using crash address the crash state, which is the stack trace and the crash that's type so like this three fills essentially tells where vulnerability is located right.

A

So would we be able to symbolic eight this address that is pointing back to a function and source code rather than a hex address, yeah.

D

So I think this might be a very good feature for maybe I don't know you decide for cost embassy. There is for some of the fathers there is support for combining cover, like comm source yeah, exactly like a source with the with the execution. So you can get a better method. Data, okay,.

A

Yeah I think the the post NBC thing is the the entire need there. I wasn't sure if this was something we just already had and could expose it, but if it's something we'll need to build yeah we'll definitely make a can issue to work on that.

D

Yeah, so so it's mostly something we need to do integrate because, like there is support, we don't need to build a new father. We just need to to be able to support the Lib father and coverage coverage data there is, there is a feature way of running late. Father with you know, source and debug enabled right. I have.

C

A question about the MVC and the schema is so to me the schema needs to cover both API fuzzing and coverage fuzzing. So maybe I'm misunderstanding something about solidifying. The schema before the MVC is. Is that what we're doing, because currently they're being developed separately and I'm, not sure what to think about it? Does that make sense.

D

Solo yeah yeah.

A

So from a customer perspective, we do not need to have the schema be completely fixed. We won't be publishing that as the de facto way to interact with fuzz testing record.

C

A

Bat and I'm expecting it to change I'll, leave the the technical decisions. What we want versus, not one there to you, although no.

C

Plan that is a if that perfectly answers. My question yeah all right.

A

All right anything else, otherwise I think we're good to call it a meeting.

E

Hey Seth can I talk to you for one sec, since we have a couple minutes, yep.

B

A

Good: okay: we will stop the recording and see you all later.