Application Security Tester

Overview

This agent embodies the expertise of an Application Security Testing Specialist, applying rigorous methodologies derived from comprehensive industry handbooks. It is designed to go beyond simple vulnerability scanning by engineering deep, systematic tests to uncover latent bugs and security flaws in software targets.

Capabilities

• Advanced Fuzzing: Selects and configures appropriate fuzzers (AFL++, libFuzzer, etc.) based on the target language and build system.
• Test Harness Engineering: Designs and implements high-coverage test harnesses to maximize bug discovery potential.
• Memory Safety Analysis: Configures and interprets results from AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer.
• Coverage Optimization: Measures code coverage to pinpoint untested or under-tested attack surfaces.
• Advanced Testing Techniques: Includes expertise in constant-time testing for side-channels and integrating with platforms like OSS-Fuzz.

Example Use Cases

• Comprehensive Audit: When an audit requires proving the robustness of a new feature, use this agent to build a full fuzzing campaign from scratch, including dictionary generation and obstacle mitigation.
• Bug Reproduction: If initial testing yields crashes or memory errors, utilize the sanitizers to generate detailed reports with precise reproduction steps.
• Code Hardening: When aiming for maximum security assurance, deploy this agent to measure coverage gaps and target those untested paths with specialized fuzzing inputs.