{"id":3945,"date":"2015-07-21T03:30:48","date_gmt":"2015-07-20T19:30:48","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3945"},"modified":"2015-07-21T03:31:01","modified_gmt":"2015-07-20T19:31:01","slug":"dharma-generation-based-context-free-grammar-fuzzing-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/07\/dharma-generation-based-context-free-grammar-fuzzing-tool\/","title":{"rendered":"Dharma &#8211; Generation-based Context-free Grammar Fuzzing Tool"},"content":{"rendered":"<p>Dharma is a tool used to create test cases for fuzzing of structured text inputs, such as markup and script. It takes a custom high-level grammar format as input, and produces random well-formed test cases as output &#8211; it can be used as a grammar fuzzing tool.<\/p>\n<p>API programming is complex and subtle programming mistakes in new code can introduce annoying crashes and even serious security vulnerabilities that can be triggered by malformed input which can lead to headaches for the user and security exposure.<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/farm1.staticflickr.com\/257\/19244320763_8432c73fa5.jpg\" alt=\"Dharma - Generation-based Context-free Grammar Fuzzing Tool\" \/><\/p>\n<p>WebAPIs start life as a specification in the form of an Interface Description Language, or IDL. Since this is essentially a grammar, a grammar-based fuzzer becomes a valuable tool in finding security issues in new WebAPIs because it ensures that expected semantics are followed most of the time, while still exploring enough undefined behaviour to produce interesting results.<\/p>\n<h3>Features<\/h3>\n<ul>\n<li>Persistent variable tracking and cross-reference support<\/li>\n<li>Intuitive cross-referencing and meta function syntax<\/li>\n<li>Automatic leaf node bias after deep graph recursions<\/li>\n<li>Internal constant overriding for greater configurability<\/li>\n<li>Templated prefix and suffix outputs<\/li>\n<\/ul>\n<p>Apart from the original features listed above the guys from Mozilla dragged Dharma out of 2012 and gave it a good working over. They improved the way it parses grammars and optimized the speed of parsing and the generating of fuzzed output, added new grammar features to the grammar specification, added support for serving testcases over a WebSocket server, and made it Python 3 ready.<\/p>\n<h3>Usage<\/h3>\n<p>Generate a single test-case.<\/p>\n<pre>% .\/dharma.py -grammars grammars\/webcrypto.dg<\/pre>\n<p>Generate a single test case with multiple grammars.<\/p>\n<pre>% .\/dharma.py -grammars grammars\/canvas2d.dg grammars\/mediarecorder.dg<\/pre>\n<p>Generating test-cases as files.<\/p>\n<pre>% .\/dharma.py -grammars grammars\/webcrypto.dg -storage . -count 5<\/pre>\n<p>You can download Dharma here:<\/p>\n<p><a href=\"https:\/\/github.com\/MozillaSecurity\/dharma\/archive\/1.1.zip\">Dharma-v1.1.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/mozillasecurity\/dharma\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dharma is a tool used to create test cases for fuzzing of structured text inputs, such as markup and script. It takes a custom high-level grammar format as input, and produces random well-formed test cases as output &#8211; it can be used as a grammar fuzzing tool. API programming is complex and subtle programming mistakes [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Dharma is a tool used to create test cases for fuzzing of structured text inputs, such as markup\/script. As such it can be used as a grammar fuzzing tool.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[10,9,29],"tags":[1278,1277,2855,1178],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3945"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3945"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3945\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}