GitLab Fuzzing, 26 Jun 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Coverage Guided Fuzzing Demo

Description

A early walk through of coverage guided fuzzing

A

I'll walk through through the demo I.

B

A

Is also a similar demo from from yesterday I think it's.

C

Also recorded, but.

A

I'll, do the same, walk through the same demo again so.

A

Alright, so here we have a little fuzzy example where we have I will walk again from from the beginning from the beginning. So we have a box again through the beginning and I show also the the project itself and the false targets. David I think you saw saw it as well, but I'll just start from the beginning, so I'll walk through this quickly.

A

B

Have a simple little.

A

Function here, which is called ARS complex, there is a bug here of my one. So given the the right input, the program will crash and we.

B

A

Sake of the example, we wrote a simple, fast tests that will find this crash automatically it's using go files, so this is centered offers based on normal, has a couple of engines and offers this case we'll use Lib fuzzer engine, which is also pretty standard, and while we use the buzzer coverage guided phaser, so you have chains lament function, fuzz, the father who pass through the random data to this function, and we are calling parse, complex and and passing this data along and using the common rich feedback.

A

The father will be smart enough to generate interesting. Data search will continue to get more and more coverage until which will hit the crash okay. So now, let's, let's see how we integrate this fastest into running in gitlab CI.

A

Okay, so this is standard github CI ya know so, as we include as we are using any other security feature and give them, including the template like including SAS, template or desc. We included coverage fuzzing channel and once we include that we need to yeah once we include that. Actually, this adds yeah sorry. So we need to include that and we need to add another stage, fuzzing stage which will be, which will will run after tests stage and for each pausing function fast test.

A

We need to create a step which extends fuzz bass and fuzz bass is something that automatically included once we are doing this line, including the coverage fuzzing template. So in this step we are compiling the.

B

A

Targets so this is standard for circuit compilation, which you can find on your files, documentation and, and then we are running, we need to run this fast target. The binary using github.

A

Yeah using github, CLI and yeah I think yeah I think I had a newer.

B

A

But anyway, yeah we need to jail, for it should be called github. Karfas is available also, and every step that extends in the first base.

A

Here we can use it any image that we use for from the build project, but we are hosting several handy images at this wrapper. This is public repo. It does not hold any source code, it just holds releases of our CLI to like binary releases and also it holds any quite a few handy, docker images with which includes several fuzzing engines, because it takes a lot of steps to usually to install like leaked files are all LLVM, so either the user has those images already or if you can use our images.

A

So here is an image with Gophers already baked inside.

A

Ok, so now now we can go to the.

C

A

Cd- and here we have something: I pushed a master so now we'll see what happens when we just push new new commits to master, and here is something that that we'll see what happens when someone opens a pull request. So.

A

A

So here is the first test and we can see that we can see the this is someone who is familiar with lit fuzzers. This is out which of Godfather's or live buzzer, and we see that it found the crash and also it found fine, sir found that the apron that causes the crash.

A

It's actually it's the word fuzzing.

A

We will have all the test cases and all the crashes that were generated currently we'll have it here in the jobs artifact.

A

So here we have, we also have the version of the father, so we can, in the future, will be able to also to reproduce everything again. So here we have the just the test cases that were generated- and here we have the crashes the crash horse is so I think this is something that you already saw in the previous version, and now we have balls because we have the GL coverage report as an output, and we so now we support it on the get love back and rails. So this is also parsed in this screen.

A

We have a new report, type of coverage fuzzing. So again, this is just initial logic that we added in the merge request that I talked about last meeting and we will add more more details here. But the current current detail screen and how the j-jason covered in Jason's report is, is a parse, so we can see the scanner provided it slipped buzzer.

A

Maybe we need to change it to a more accurate, because this is like Wasley father and not see Sifu school sleep buzzer, the scanner type is coverage fuzzing severity, our CLI else also to classify severity for some crashes. I didn't pour this part of the code yet, but I'll do that in the next version, so we'll have also severity for some of the crashes. We have a crash state here and we have the also the crash type, which is index south of French, which is exactly the the bug that that happened in our example.

A

So this is kind of the demo for now things that we will add in the future, and just on top of my head is various links and to download crashes.

A

Of course, then you can elaborate on this as well right I'm, just talking about this screen, so we'll have some links to to be able to download the crashes in a more handy.

B

Way than going back.

A

To the like, artifact screens, we have also they will have also the button here for the MVC, which is available, and some of the issues for the MVC will have a button here, so so I need the user can download the whole artifacts in one click and I think in the future. Currently, currently, we only parse the report, but in the next larger quest in the next version.

A

We also should see this vulnerability in the security dashboard because currently, as far as I understand it's not in the database yet so we only see this in the pipeline security dashboard here yeah, so that's so feel free to address questions. Anything yes,.

D

So you just kind of led to my first question, which is: can you see it on the merger quest today or is it not available in the merge request.

A

D

A

D

Security, finding you showed in the pipeline report yeah does that show up on your merger quest as well, oh yeah, so on the.

A

Merge request: what particularly happened in the merge request is that we we only ran through through these test cases in this particular request, so it didn't find any any questions, just just for the sake of the example to see what happens if there are no crashes, but essentially what will happen again?

A

I'll push this change is that what we decided is that in the regression we will also run short, fuzzing Accession, so actually it would also find the same crash and unless, unless we fix I'll open another I'll push this change and open another of marriage requests with with the fix, so you will see that there is no. ah You know yeah.

C

There is no crashes and.

A

C

Maybe what you're asking is we're seeing it on the pipeline view and David? Maybe what you're asking is, if you click on that explanation, one update parse complex right below your to the right of your cursor. This.

A

C

Going up yeah keep going up just a little bit, so that's the the merger quest and David, maybe there's what you're asking is: will it show up as a as a widget like we've got this.

D

C

D

Yeah would the security scan things show up and it would show the pose finding from that commit.

C

And my understanding is most likely not because we have a separate report type. So we've got a SAS report, type, a report, type of coverage on buzzing report type and the coverage report type. We have not updated a widget to display the results here. Okay,.

D

Yeah, that was the question. Is that it's good to see it on the pipeline view, but usually people would look at it here right, because you've opened up a merge request. You push code into Co got scan, it says, need to be there for next week's customer advisory board. It's more of a question that can I go there to show that if it's there and it sounds like what you're saying Seth is that implementation is TBD, so it shows up in the security merge request. Widget, that's fair.

C

Yeah, it shows up on the pipeline page. Yes, it.

D

Only shows on the pipeline page not show up when you are correct.

C

And my understanding is even those- maybe someone can correct me if I'm wrong, but that merge request. Widget is kind of a moving target. I think threat insights is actually doing away with those widgets to have that as a dedicated page. No.

D

C

D

What they're doing is they're updating it to be more accurate, like did displaying? What is the actual state so like in the case of the video that Marcel made is there's like 200 Varner abilities detected, but really there's not 200. That count includes everything else is it has been previously fixed, but they never merged down to two master. So it couldn't tell you the delta to say there were only two new ones. Instead of two hundred mm-hmm.

C

D

We're fixing that functionality, but they're gonna leave the widget now, when you click on light and it'll, take you to the dedicated page instead of the amodal yep, that's per the word. Okay,.

C

Yeah we have not so.

D

B

We get the yeah once we get the buzz findings, integrate with sandal and vulnerabilities I, believe the widget information will start being displayed because that widget is being driven off of all the stand and vulnerabilities is my understanding, so it should show up as part of the widget and the security dashboard all at the same time. Okay, but that's the part we haven't done yet yeah.

C

And yeah we have to check that because traditionally those widgets have been independent, so you'd have won 4-1 for sass, so on and so forth, and they may have been consolidated into a single widget but I don't know the latest date on that I. Don't.

D

Think that I don't think they're merging them together. I can follow up with Matt on that, because I think it makes more sense than broken out. So you can see well that was a sass result of that's a test result right. I'm follow up with him all night yep.

D

My next question is in your demo here, where you're finding the default using Lin foes or go foes. Have you enabled sassed on this repository as well? So you can see that sass didn't detect the problem, because it's.

A

Not so vulnerable 'ti yeah.

D

Yeah, actually one additional line in there yeah again, you're included you just quit the sass temple. Oh yeah,.

A

So it's not included here can I include it here. You can see that only the coverage like the title is missing here, but I'll leave. The coverage fuzzing is enabled now yeah, so yeah we can. We can enable it for the demo. Yes, yeah.

D

I just say it's a Sam's positioning in his upcoming blog, the settings put on the home on the Direction page really talks about like this finds things. Traditional scanners, don't fine, which I think we all agree is the case of fuzzing, but to kind of show that in a quick demo to someone, if we add in the SAS template SAS would run I, don't think SAS is gonna, find the error that you're finding of getting in the names like you can see your access and find it.

D

But because you ran this, you now know there's a problem here: yeah.

A

Okay sounds good, okay, yeah and now so sander I replicated in the environment and they move the GCP demo. So long I'll send the link in the channel as well together. Then then, let me know either if you want to record it with with your own rhythm and voice, then hey. If you want to like me to record it.