Dharma – Generation-based Context-free Grammar Fuzzing Tool

Keep on Guard!

Dharma is a tool used to create test cases for fuzzing of structured text inputs, such as markup and script. It takes a custom high-level grammar format as input, and produces random well-formed test cases as output – it can be used as a grammar fuzzing tool.

API programming is complex and subtle programming mistakes in new code can introduce annoying crashes and even serious security vulnerabilities that can be triggered by malformed input which can lead to headaches for the user and security exposure.

Dharma - Generation-based Context-free Grammar Fuzzing Tool

WebAPIs start life as a specification in the form of an Interface Description Language, or IDL. Since this is essentially a grammar, a grammar-based fuzzer becomes a valuable tool in finding security issues in new WebAPIs because it ensures that expected semantics are followed most of the time, while still exploring enough undefined behaviour to produce interesting results.


  • Persistent variable tracking and cross-reference support
  • Intuitive cross-referencing and meta function syntax
  • Automatic leaf node bias after deep graph recursions
  • Internal constant overriding for greater configurability
  • Templated prefix and suffix outputs

Apart from the original features listed above the guys from Mozilla dragged Dharma out of 2012 and gave it a good working over. They improved the way it parses grammars and optimized the speed of parsing and the generating of fuzzed output, added new grammar features to the grammar specification, added support for serving testcases over a WebSocket server, and made it Python 3 ready.


Generate a single test-case.

Generate a single test case with multiple grammars.

Generating test-cases as files.

You can download Dharma here:


Or read more here.

Posted in: Exploits/Vulnerabilities, Hacking Tools, Programming

, , , , , , , ,

Recent in Exploits/Vulnerabilities:
- US Voting Machines Hacked At DEF CON – Every One
- CrackMapExec – Active Directory Post-Exploitation Tool
- EvilAbigail – Automated Evil Maid Attack For Linux

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 238,749 views
- AJAX: Is your application secure enough? - 120,801 views
- eEye Launches 0-Day Exploit Tracker - 86,355 views

Comments are closed.