MIST – a tool pairing SAST and Fuzzing for smarter Bug Hunting Alessandro Palazzolo released MIST, an open-source Python framework under the Apache License 2.0 that orchestrates static application security testing (SAST) and dynamic testing by pairing Semgrep-based pattern analysis with Directed Greybox Fuzzing via a modified AFLGo, turning static findings into targeted fuzzing campaigns. MIST's author claims the combination reaches results comparable to Symbolic Execution and semantic code analysis at considerably lower time and computational complexity, and ships both a local install and a Docker Compose containerized option. The tool is aimed at developers who want a lightweight, modular and extensible pipeline for vulnerability hunting. Smoothly transform static analysis findings into tailored fuzzing campaigns. MIST orchestrates the vulnerability analysis workflow, standardizing and automating the steps unifying SAST and DAST, so that you can focus on security reasoning while it takes care of the analysis pipeline. Designed to remain comparatively lightweight while obtaining competitive efficiency. MIST integrates technologies, including Directed Greybox Fuzzing DGF and pattern-based static analysis, that once synergized can achieve results comparable to state-of-the-art approaches, such as Symbolic Execution SE and semantic code analysis, maintaining considerably lower time and computational complexities. For developers. MIST can be employed as a light, modular and extensible Python framework, to create new plugins and standalone tools. The whole project is realeased under the Apache License 2.0, and its source code is freely available to inspect, study, modify, extend, and build upon, encouraging experimentation and further development. "Given enough eyeballs, all bugs are shallow" Clone and enter the repository: git clone https://github.com/alessandroPalazzolo/mist.git cd mist - The local installation supports all features and is recommended for more in-depth and advanced use. However, when dealing with fuzz testing, some operations may directly affect the host system, so additional care is required. Some additional tweaking might be required based on your system configuration. - The containerized version provides complete isolation from the host system, making it the safest option while providing a ready-to-use environment. Nonetheless, as documented in the relevant section, some features may be limited or behave differently due to Docker's isolation mechanisms. Docker is therefore recommended for testing MIST or trying it for the first time. Below are the steps required for the local installation . See the Docker run-mist-with-docker section to run MIST in a container. Create and activate a virtual environment unless you want a global install : python3 -m venv .venv source .venv/bin/activate Install the python3 mist wheel with dependencies: pip install -e . Mist leverages AFLGo directed greybox fuzzer for DAST. See more at https://github.com/aflgo/aflgo https://github.com/aflgo/aflgo . Caution AFLGo build script will attempt to apply modifications on your host system, potentially affecting your existing compiler toolchain. The AFLGo documentation https://github.com/alessandroPalazzolo/mist/blob/main/AFLGo/Readme.md explains each action taken in depth, still, if you don't feel confident with it you might want to check the Docker installation run-mist-with-docker . Build the fuzzer: cd AFLGo sudo ./build.sh cd .. You ideally only need this to make AFLGo work. If you encounter any issue refer to the official documentation https://github.com/alessandroPalazzolo/mist/blob/main/AFLGo/Readme.md for better support. Note MIST only works with a slightly modified version of AFLGo, see more at THIRD PARTY NOTICES https://github.com/alessandroPalazzolo/mist/blob/main/THIRD PARTY NOTICES.md . You can provide a custom AFLGo version, but should only apply your edits on the one shipping with MIST. Tip if you don't wish to use a global custom semgrep installation you can skip this step. MIST employs Semgrep capabilities for efficient SAST. See more at https://docs.semgrep.dev https://docs.semgrep.dev . Semgrep conveniently exposes a python package that can be installed with pip install semgrep , for this reason it is already included as a mist wheel dependency and should be locally installed. If you wish to use a global semgrep installation you need to run: pipx install semgrep then proceed to edit your $PATH accordingly, so that mist sees it first. You can now start exploring MIST by simply typing: mist Seamlessly build and run MIST using Docker Compose. Assuming that you are in the mist/ root directory, run: H WORKSPACE=