Table of Contents
Instructional Video on Using Dinkel
[TODO: insert mp4 here]
Dinkel is a state of the art Cypher fuzzer.
It employs on-the-fly state manipulation and self-generating ASTs to generate complex and valid queries with countless data dependencies.
For more detailed information on how dinkel works and performs, please refer to its paper.
Requirements:
- Go 1.22.0 or higher
Install dinkel:
$ go install github.com/CelineWuest/dinkel@latest
You should now be able to run dinkel from the command line using dinkel.
If you encounter an error, ensure that the GOBIN environment variable is set and in your path.
Alternatively, you may clone this repository and build dinkel locally
$ git clone git@github.com:CelineWuest/dinkel.git
$ cd dinkel
$ go build
You should now have a binary which you can run via ./dinkel.
⚠ Never run dinkel against a database holding data you don't want to lose, as it will get deleted. ⚠ ️
If you need more info about a certain command, run
dinkel help [command]
Ensure you have a config in your present working directory.
If you cloned the repository, this config will already be in the project's root directory.
Otherwise, you can generate the config by running
dinkel config
Before you start fuzzing a target, spin up an instance of said target. For this, you may want to use the already provided dockerfiles contained in this project's dockerfiles directory. To then fuzz the target, run
dinkel fuzz target [strategy]
You can list available targets and strategies using dinkel help fuzz.
Once a bug was found and a bug report got generated, run
dinkel reduce path/to/bugreport.yml
to reduce the generated query. Note that the reduction is not perfect and you might still have to further reduce the query manually.
To make sure dinkel doesn't report the same bug again, add a regex matching the error message to the targets config.
The entry should be added to the list <the target>.reportedErrors in the config.
You can check that the regex correctly matches the error message by rerunning the bugreport and making sure dinkel now recognizes the query as a REPORTED_BUG.
If you found multiple bugs and thus have a lot of bugreports, you might find use in the command
dinkel bugreports
With this command you can easily rerun, regenerate, reduce, rename and delete your bug reports.
If you wish to run the fuzzer for a prolonged time you might want to monitor its performance.
You can do this by enabling the builtin prometheus exporter with the --prometheus-exporter port flag in the fuzz command.
Setting this flag exposes the /metrics HTTP endpoint on the specified port, exposing prometheus metrics.
These metrics include:
- query counts
- statement counts
- generation latencies
- query latencies
- count of query result types
If you are a developer of a graph database management system and would like specific features in Dinkel or want to extensively test a new language feature before it becomes open source, feel free to contact us under inquiry@dinkel-fuzz.ch.
Please don't hesitate to create issues if you find a bug in dinkel or wish to share an idea to improve the tool.
Feel free to open a pull request if you have made any improvements to dinkel!
Please refer to the contributing guidelines for more information about how to contribute.
You might have an easier time getting started with developing dinkel after reading its paper.
If you find a bug using dinkel, remember to responsibly disclose it to the respective developers.
Once the bug is fixed, you may send an E-Mail to bugs@dinkel-fuzz.ch, containing a subject starting with "[Bug]".
Neo4j
- A
- B
- C
FalkorDB (Formerly known as RedisGraph)
- A
- B
- C
Apache AGE
- A
- B
- C
Memgraph
- A
- B
- C
Made with ❤️ at ETHZ