Fuzzing

                                 Fuzzing

     

                                                                                                BY.MICKY  VERMA

Fuzzing is a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer program.

The program is then monitored for exceptions such as crashes, or failing built-in code assertions or for finding potential memory leaks. Fuzzing technique is commonly used to test for security problems in software or computer systems answers also used to discover coding errors and security loopholes in software, operating systems or networks by inputting massive amounts of random data, called fuzz, to the system in an attempt to make it crash. If a vulnerability is found, a tool called a fuzz tester (or fuzzer), indicates potential causes.

There are two forms of fuzzing program; mutation-based and generation-based, which can be employed as white-, grey- or black-box testing. File formats and network protocols are the most common targets of testing, but any type of program input can be fuzzed. Interesting inputs include environment variables, keyboard and mouse events, and sequences of API calls. Even items not normally considered “input” can be fuzzed, such as the contents of databases, shared memory, or the precise interleaving of threads.

A fuzzer would try combinations of attacks on:

– numbers (signed/unsigned integers/float…)

– chars (urls, command-line inputs)

– metadata : user-input text (id3 tag)

– pure binary sequences

Fuzzing best work for problems that can cause a program to crash, such as buffer overflow, cross-site scripting, denial of service attacks, format bugs and SQL injection. These schemes are often used by malicious hackers intent on wreaking the greatest possible amount of havoc in the least possible time. Fuzz testing is less effective for dealing with security threats that do not cause program crashes, such as spyware, some viruses, worms, Trojans and keyloggers.

---

FUZZING TOOLS:

> Fuddly: Fuzzing And Data Manipulation Framework.

> 0d1n Open Source Web HTTP Fuzzing Tool And Bruteforcer.

> Wfuzz A Tool Designed For Bruteforcing Web Applications.

> UniOFuzz 0.1.2-beta – Universal Fuzzing Tool

UniOFuzz version 0.1.2-beta – the universal fuzzing tool for browsers, web services, files, programs and network services/ports released by null security team.

> Basic Fuzzing Framework (BFF) based on Linux & Mac OSX Fuzzer Tool By CERT

The CERT Basic Fuzzing Framework (BFF) is a software testing tool that finds defects in applications that run on the Linux and Mac OS X platforms. BFF performs mutational fuzzing on software that consumes file input. (Mutational fuzzing is the act of taking well-formed input data and corrupting it in various ways, looking for cases that cause crashes.) The BFF automatically collects test cases that cause software to crash in unique ways, as well as debugging information associated with the crashes. The goal of BFF is to minimize the effort required for software vendors and security researchers to efficiently discover and analyze security vulnerabilities found via fuzzing...,

Download