Fuzz testing consists in automatically generating and sending malicious inputs to an application in order to hopefully trigger a vulnerability. Fuzzing entails such questions as: Where to fuzz? Which parameter to fuzz? Where to observe its effects?

Browsers have become an interface to perform a plethora of activities. This situation led to the integration of various software components in browsers, including interpreters for many web-friendly scripting languages e.g. JavaScript. In this article, we propose an application of genetic programming to the area of fuzzing the interpreters by generating codes that may trigger crashes and thereby indicating the presence of some hidden vulnerabilities. Based on our previous work on smart fuzzing with genetic approaches, we present here elements for an extension of the concept to fuzz browser interpreters.

We present an approach to detect web injection vulnerabilities by generating test inputs using a combination of model inference and evolutionary fuzzing. Model inference is used to obtain a knowledge about the application behavior. Based on this understanding, inputs are generated using genetic algorithm (GA). GA uses the learned formal model to automatically generate inputs with better fitness values towards triggering an instance of the given vulnerability.

Designing a security policy for an information system is a non-trivial task. In this paper, we consider the design of a security policy based on a variant of the RBAC model, close to SecureUML. This variant includes constraints for the separation of duty, as well as contextual constraints. Contextual constraints use information about the state of the functional model of the application to grant permissions to users. These constraints add flexibility to the security policy, but make its validation more difficult. In this paper, we first review two tools, USE and SecureMOVA, which can be used to analyse and validate a security policy. These tools focus on analyses of static aspects of the secured system. We then propose a new tool, based on the Z formal language, which uses animation of the specification to validate the static as well as dynamic aspects of the security policy, taking into account possible evolutions of the state of the functional model. We discuss how the security policy and the functional application are described to the tool, and what kind of queries and animations can be performed to analyse nominal and malicious behaviours of the system.

Several studies have shown that automated testing is a promising approach to save significant amounts of time and money in the industry of reactive software.But automated testing requires a formal framework and adequate means to generate test data.In the context of synchronous reactive software, we have built such a framework and its associated tool -Lutess-to integrate various well-founded testing techniques.This tool automatically constructs test harnesses for fully automated test data generation and verdict return.The generation conforms to different formal descriptions: software environment constraints, functional and safety-oriented properties to be satisfied by the software, software operational profiles and software behavior patterns.These descriptions are expressed in an extended executable temporal logic.They correspond to more and more complex test objectives raised by the first pre-industrial applications of Lutess.This paper concentrates on the latest development of the tool and its use in the validation of standard feature specifications in telephone systems.The four testing techniques which are coordinated in Lutess uniform framework are shown to be well-suited to efficient software testing.The lessons learnt from the use of Lutess in the context of industrial partnerships are discussed.

Lutess is a tool that we developed for testing reactive synchronous software and which is being used in different industrial contexts. It offers several formal testing methods with automatic generation of test data from the environment specification. Lutess provides also an approach to assign a probability to the next event issued by the environment. However, a Lutess' user faces the problem of expressing operational profiles with sophisticated and varying probability assignments to software inputs, in a format directly usable by Lutess. The paper concentrates on how to express operational profiles for specifications which are implemented as binary decision diagrams.