Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Final Submission: Fuzzing Executable Tutorial #1705

Merged
merged 5 commits into from
Apr 6, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
35 changes: 32 additions & 3 deletions contributions/executable-tutorial/palagi-civjan/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

## Title

Integrating OSS-Fuzz into Go project to demonstrate debugging with modern fuzzing techniques
Katacoda Executable Tutorial demonstrating and explaining Fuzzing

## Names and KTH ID
- Brad Palagi ([email protected])
Expand All @@ -20,6 +20,35 @@ Executable Tutorial

Fuzz testing is an essential topic for testing and security.

We will create a browser based jupyter-notebook with the goal of teaching the user how to effectively use OSS-Fuzz to debug a Go project.
We created a Katacoda Scenario with the goal of teaching the user how to effectively use Atheris, Google's Python Fuzzing tool which is a part of OSS-Fuzz and can be integrated into ones own git repository using ClusterFuzzLite.

In our tutorial we will include descriptions of what **fuzzing** is as a debugging technique as well as show how OSS-Fuzz can be used in practice to create a CI-based fuzz testing development cycle.
In the tutorial we covered: Background information on fuzzing as a testing technique, the Pros and Cons of Fuzzing versus standard or other testing methods, how to integrate Google's Atheris Python fuzzer with a Python program, and how to add this type of fuzzing into a CI workflow with GitHub Actions using ClusterFuzzLite.

Final Submission Links:

Katacoda-Scenario Repository: https://github.com/bencivjan/katacoda-scenarios <br />
Katacoda-Scenario Tutorial: https://www.katacoda.com/bencivjan/scenarios/fuzzing-exec-tutorial

Fuzzing Workflow Flowchart: <br />
![Image](FuzzFlowChartV1.jpg)


<br />
<br />
<br />

**Grading Criteria We Intended To Meet**

| | Yes | No |
|-------------------------------------------- | ----|----|
|executable: The tutorial can be automatically executed from beginning to the end, in the browser or in CI (see below) | **Mandatory** | - |
|ilo: The tutorial states the intended learning outcomes. | **Mandatory** | - |
|motivation: The tutorial is clearly motivated (why it matters for Devops?) | **Yes** | No |
|browser-based: The tutorial can be successful executed in the browser (katacoda is recommended) | **Yes** | No |
|ci-based: The tutorial can successful be executed as a CI job | *Yes* | No |
|background: The tutorial gives enough background | **Yes** | No |
|illustrated: The tutorial is illustrated with an informative figure (eg a flowchart) | *Yes* | No |
|pedagogical: The tutorial is easy to follow | **Yes** | No |
|original: The tutorial is original, no or few similar tutorials exist on the web | **Yes** | No |
|easter-eggs: The tutorial contains an easter egg | *Yes* | No |
|language: The language is appropriate (structure, grammar, spelling) | **Yes** | No |