Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been looking for guides and tutorials about how to fuzz and so far everything I have seen has been for web servers. If I wanted to fuzz something along the lines of calc.exe or a program that echoed back arguments passed to it. What framework should I use and how should I go about it. I am looking for help fuzzing an application which receives 0 network traffic and receives input via dialog boxes or command line arguments.

share|improve this question
add comment

3 Answers

Updated answer: If you are using Windows, try the CERT Failure Observation Engine (FOE). It is a fuzzing framework for Windows. It has the ability to do file-based fuzzing, to click on dialog boxes, and other stuff.


Previous answer: I suggest you start with zzuf. It is the simplest, easiest to use command-line fuzzer for fuzzing standalone programs that read their input from files, stdin, or the command line. It is extremely easy to use, and a good starting point.

You could also look at the CERT Basic Fuzzing Framework.

Then if you want to get more sophisticated you can look at other fuzzers (Spike, etc.), but that'll get you started.

If you want to fuzz programs that receive input via dialog boxes, sorry, I don't know what to recommend.

share|improve this answer
add comment

You can fuzz GUI using Peach Fuzzing Framework (http://peachfuzzer.com)

Here is an article about it: http://phed.org/2008/01/13/peach-21-fuzzing-gui-applications/

share|improve this answer
add comment

if you want to Fuzz Web Applications there is powerful and easy-to-us fuzzing in acunetix web application security scanner and OWASP Fuzzing projects like JBroFuzz , etc. Also your welcome to use fuzzer frameworks such as and not limited to Peach ( you must have a skills for peach pit XML building, plus there is not enough document for it, of curse). SPIKE and other utility are available in Kali Linux or Backtrack and penetration testing Linux distribution, Finally if you have a skills in programming ( C, Python, ...) you can build your own special Fuuzer, too

Good luck

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.