Format-Aware Black-Box Fuzzer

An individual security-tooling project that explores black-box program behavior through structured mutation and repeatable failure capture.

Problem / goal

Random fuzzing is difficult to debug when triggering inputs are not saved, categorized, or associated with observable output behavior.

My role

Security Tool Developer for an individual Python project.

What I personally contributed

• Built format-aware mutators for CSV, JSON, XML, JPEG, and plaintext inputs.
• Implemented timeout handling and capture for crashes, hangs, slow paths, and unusual output signatures.
• Containerized target execution and saved exact triggering inputs for deterministic reproduction.

Technical approach

• Applied format-aware transformations that preserve enough structure to reach deeper parser behavior.
• Wrapped target execution with time limits, exit-code checks, output-signature tracking, and repeatable input storage.
• Packaged the workflow with Docker and Bash so stdin-driven binaries could be tested in a consistent environment.

Key features

• Structured and unstructured input mutation.
• Crash, hang, slow-path, and unusual-output classification.
• Exact triggering-input preservation.
• Dockerized and reproducible execution workflow.

Impact / results

• Delivered a reusable black-box testing workflow for stdin-driven binaries.
• Preserved actionable test cases that could be replayed during debugging instead of reporting non-reproducible failures.

What I learned

• A security testing tool becomes more useful when every detected failure includes a deterministic reproduction artifact.
• Format-aware mutation can exercise parser logic more effectively than arbitrary byte changes alone.