Fuzzing is a testing technique that consists on passing malformed data as input to programs trying to uncover vulnerabilities in the handling of this malformed input data.

learn more… | top users | synonyms

0
votes
0answers
53 views

Google Chrome Crash Report Analysis

I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though. ...
3
votes
1answer
49 views

Fuzzing of audio input vectors

A few days ago I had to make a phone call and on the other end of the line was some machine using some voice recognition software to validate the customers spoken answers to the service menu. I asked ...
2
votes
3answers
130 views

How can NSA see everything without us noticing that? [closed]

Here's one thing that keeps bugging me ever since I heard about the NSA revelations. From what I heard, NSA built a system that basically sees most of the internet, made of many subsystems which ...
2
votes
1answer
58 views

Web crawler for gathering seed files for mutation based fuzzer

I am looking for a good tool that allows me to crawl the web for files of a certain format for use as seeds to a mutation based fuzzer (e.g. zzuf). For instance, let's say I am looking for ZIP files ...
0
votes
1answer
107 views

Fuzzdb detected as Trojans [closed]

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?
4
votes
1answer
301 views

Exploitability of use-after-free vulnerabilities

Use-after-free bugs are a particular class of memory safety bugs. How often are they exploitable, in practice? When you find a use-after-free bug in a program, is it often exploitable, rarely ...
9
votes
2answers
708 views

Black-box fuzzing a TCP Port running an unknown applicaiton

I'm looking for any guidance around testing a service I've found running on a target server. I'm doing a 'black-box' pen-test and the company is one of those 'I-don't-want-to-tell-you-anything' types ...
1
vote
1answer
382 views

Fuzzer causes crash. Now what?

Can anyone point me in the direction of some good tutorials regarding how to identify the type of vulnerability as reported by !exploitable and where to go from there? Essentially I've got myself a ...
2
votes
1answer
74 views

Test suite for a white-box fuzzer

I have created a white-box fuzzer by extending the Crest. Now, I'm looking for a test suite (a set of c programs with known vulnerabilities) to test the functionality of my tool. where i can find ...
3
votes
2answers
387 views

Work on fuzzing of PDF file format

What work has been done on fuzzing of the PDF file format? I'm looking for work that focuses specifically on PDF, and is aware of the PDF file format. Has there been past work that builds ...
2
votes
1answer
98 views

Does it have sense to fuzz a ASCII file format with mutators that mess with Unicode or String Case?

I'm trying to fuzz an ASCII file format. Specifically, I'm defining some HTML5/HTML structures to be used as definition file for a smart fuzzer to fuzz web browsers. This smart fuzzer allows to ...
3
votes
0answers
153 views

CERT FOE Fuzzing Framework documentation

So I read another post here about fuzzing local standalone applications. I have understood how to exploit basic buffer overflow vulnerabilities in standalone applications and am now looking on how to ...
6
votes
3answers
377 views

How to fuzz proprietary protocol over SSL?

I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
3
votes
1answer
159 views

Best option to fuzz a C Network Program [closed]

I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
2
votes
3answers
974 views

What's a good fuzzing framework for fuzzing a local standalone application?

I have been looking for guides and tutorials about how to fuzz and so far everything I have seen has been for web servers. If I wanted to fuzz something along the lines of calc.exe or a program that ...
4
votes
2answers
742 views

SQL Injection - Automating the fingerprinting of the DBMS

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS. I am in ...
6
votes
1answer
5k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
1
vote
0answers
220 views

Fuzz a client with sulley [closed]

I want sulley to bind to an interface, wait for a connection and fuzz the reply to the client. How can I act as a server with sulley to fuzz a client ?
4
votes
1answer
677 views

How to fuzz on FreeFloat FTP server using SPIKE Fuzzing?

I would to seek help on using SPIKE fuzzer to fuzz an FTP server which I am testing on Freefloat FTP server but do not have idea on how to work on. As I research and tested out many different types of ...
2
votes
1answer
512 views

Fuzzing tool to find heap overflows in a Windows binary

Is there a fuzzing tool that can scan some arbitrary windows binary and identify a set of heap overflow vulnerabilities? For example, a tool that applies a set of heuristics or maybe a list of ...
23
votes
4answers
3k views

What is the purpose of a fuzzer?

I've heard of these tools and from what I understand, they just send tons of random data at different services and observe their reaction to it. What is the purpose of a fuzzer? How can it be ...
1
vote
1answer
812 views

Fuzzing Android API

I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from ...
-1
votes
3answers
474 views

Code auditing and/or fuzzing - Books and resources

I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
4
votes
1answer
135 views

Sulley - only using ASCII printable characters

I have a problem fuzzing FTP protocol. An example of a command fuzzed is the following data model, which should fuzz the "CWD [string]" command of the FTP protocol. s_initialize('CWD') ...
6
votes
1answer
398 views

Sulley - optional element and command check

I'm currently using Sulley to fuzz my FTP server, but I'm having problems. I want to specify the STRU command, which has a syntax: STRU [<SP> F|R|P] <CRLF> I tried to specify the ...
4
votes
2answers
1k views

Fuzzing with SPIKE - the \r\n not being taken into account

I would like to fuzz FTP protocol, and currently I have the following: s_read_packet(); s_string("USER test\r\n"); s_read_packet(); s_string("PASS test\r\n"); s_read_packet(); I've also tried ...
1
vote
1answer
788 views

How can I fuzz standalone applications?

How can I fuzz standalone applications because I can't seem to wrap my head around how a fuzzer can "feed" fuzz data to a standalone application. Most online resources use web servers as examples. ...
2
votes
1answer
411 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
7
votes
3answers
2k views

What does a common workstation setup look like for pentesting and vulnerability research?

I'm a security enthusiast, and am in need of some guidance to get me into the branch. I've always been held back by lack of methodology in my research, and it tends to break down my motivation towards ...
8
votes
3answers
1k views

Vuln research: reverse engineering, debugging or fuzzing?

I wonder how hackers find vulnerabilities. If they use fuzzing, security engineers do it, and it's probably that security engineers (that work in a firm) have more resources than a group of hackers. ...
3
votes
2answers
206 views

Software suggestions on building a “passive” and “active” WAN simulation and fuzzing device?

I want to build a more-or-less self-contained box that I can plug two or more endpoints into (routers, mainly) that will simulate a WAN. I want to be able to mess up traffic in all sorts of ways, both ...
10
votes
3answers
657 views

Best way to triage crashes found via fuzzing, on Linux?

When doing fuzz testing, it is easy to end up with many bugs (many crashes). This makes it important to have a way to triage each bug that's detected, so we can prioritize them and focus our effort ...
6
votes
3answers
442 views

How should I compile program for fuzz testing?

I'm doing some fuzz testing of a program for which I do have source code. Should I compile the program with any particular compiler options, to make fuzz testing more effective? If so, what's the ...
4
votes
3answers
324 views

How should I configure OS for fuzz testing?

Should I configure my OS in any particular way, if I'm going to be doing some fuzz testing? Should I turn off ASLR (address space randomization)? Does it matter?
7
votes
1answer
303 views

How many iterations of fuzzing is enough?

Fuzzing is a convenient, relatively low-cost way to detect some kinds of vulnerabilities, particularly in C/C++ code. My question: How much fuzzing is enough? Are there are any standards or best ...