I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities:
Bypass a restriction or similar Cross Site Scripting Denial of service Directory Traversal Execute arbitrary code on vulnerable system Gain Privileges Http Response Splitting Memory Corruption Obtain information Overflow vulnerability (includes stack and heap based overflows and other overflows) Cross site request forgery(CSRF) File Inclusion Sql Injection
What I would like to know is the following: can any software testing be considered fuzzing. So for example if I'm looking for SQL injections in some web application (like some CMS system) with sqlmap, havij, sqlninja, can that be categorized as fuzzing? Because on the other side, in all papers fuzzing is only references when looking for buffer overflows - stack overflows, heap overflows, integer over/underflows, format string bugs.
So I guess I'm asking is the following: can discovering any vulnerability with any automated tool be categorized as fuzzing?
Thank you in advance