1. Use one or multiple valid URL strings as seed inputs
2. Randomly mutate the seed inputs to obtain various mutated input strings
3. Evaluate those input strings and obtain their line coverage
4. Select input strings with many new, uncovered lines as seed inputs.
5. Repeat until cannot obtain new coverage for some number of consecutive iterations.

Mutating Input Strings

The fuzzer has a mutation function that takes as input a string and randomly mutates it (and returns the mutants).

• Delete: delete a random char in the string
• Insert: insert a random char into the string
• Swap: swap two random chars in the string
• Replace: replace a random char in a string with another random char (equiv to delete + insert)

If you don't have GCC installed, you'll need to install it. The installation steps depend on your operating system.

Linux: On most Linux distributions, you can use your package manager to install GCC. For example, on Ubuntu or Debian, you can run:

sudo apt-get update
sudo apt-get install gcc

Windows: If you're using Windows, you can install GCC by installing a package like MinGW or Cygwin.

• Linux: You typically don't need to do anything, as the package manager handles adding paths to the system environment.

• Windows: If you're on Windows, you'll need to manually add the directory containing the gcc executable to the PATH.

$ gcc --coverage -o test.exe test.c
$ ./test.exe 'Send+mail+to+me%40unl.edu'

The input executable test program (e.g., test.exe) is a CGI decoder, which takes as input a string CGI encoded string (e.g., a URL, web address) and convert it to the original string before the encoding.

$ ./test.exe "Hello+World"
Hello World

$ gcov test.exe.c   # generate the .gcov file
$ less test.exe.c.gcov    # your fuzzer will parse in this file and analyze its contents

The fuzzer takes as input an executable program (given as a string indicating the full path of the file) and output 2 lines: the first is a nonnegative number indicating the number of explored statements and the second is a sorted, comma-separated list of unique id's of statements that were covered.

$ ./fuzzer.exe /path/to/test.exe
1000
test.c:1, test.c:2,  ...  test.c:1000

The fuzzer also takes as input an argument -show, and outputs (e.g., at iteration X, the fuzzer generated Y inputs and covered Z unique lines).

$./fuzzer.exe /path/to/test.exe -show
....  # some progress
1000
test.c:1, test.c:2,  ...  test.c:1000