The fuzzing tag has no wiki summary.
3
votes
1answer
85 views
Best option to fuzz a C Network Program
I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
3
votes
2answers
112 views
What's a good fuzzing framework for fuzzing a local standalone application?
I have been looking for guides and tutorials about how to fuzz and so far everything I have seen has been for web servers. If I wanted to fuzz something along the lines of calc.exe or a program that ...
4
votes
2answers
220 views
SQL Injection - Automating the fingerprinting of the DBMS
I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS.
I am in ...
5
votes
1answer
238 views
SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns
I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
1
vote
1answer
468 views
How can I fuzz standalone applications?
How can I fuzz standalone applications because I can't seem to wrap my head around how a fuzzer can "feed" fuzz data to a standalone application.
Most online resources use web servers as examples. ...
1
vote
0answers
99 views
Fuzz a client with sulley [closed]
I want sulley to bind to an interface, wait for a connection and fuzz the reply to the client. How can I act as a server with sulley to fuzz a client ?
4
votes
1answer
186 views
How to fuzz on FreeFloat FTP server using SPIKE Fuzzing?
I would to seek help on using SPIKE fuzzer to fuzz an FTP server which I am testing on Freefloat FTP server but do not have idea on how to work on. As I research and tested out many different types of ...
9
votes
3answers
457 views
Best way to triage crashes found via fuzzing, on Linux?
When doing fuzz testing, it is easy to end up with many bugs (many crashes). This makes it important to have a way to triage each bug that's detected, so we can prioritize them and focus our effort ...
4
votes
2answers
666 views
Fuzzing with SPIKE - the \r\n not being taken into account
I would like to fuzz FTP protocol, and currently I have the following:
s_read_packet();
s_string("USER test\r\n");
s_read_packet();
s_string("PASS test\r\n");
s_read_packet();
I've also tried ...
2
votes
1answer
153 views
Fuzzing tool to find heap overflows in a Windows binary
Is there a fuzzing tool that can scan some arbitrary windows binary
and identify a set of heap overflow vulnerabilities?
For example, a tool that applies a set of heuristics or maybe a list of ...
6
votes
3answers
319 views
How should I compile program for fuzz testing?
I'm doing some fuzz testing of a program for which I do have source code. Should I compile the program with any particular compiler options, to make fuzz testing more effective? If so, what's the ...
8
votes
3answers
525 views
Vuln research: reverse engineering, debugging or fuzzing?
I wonder how hackers find vulnerabilities.
If they use fuzzing, security engineers do it, and it's probably that security engineers (that work in a firm) have more resources than a group of hackers.
...
22
votes
4answers
2k views
What is the purpose of a fuzzer?
I've heard of these tools and from what I understand, they just send tons of random data at different services and observe their reaction to it.
What is the purpose of a fuzzer? How can it be ...
6
votes
1answer
261 views
Sulley - optional element and command check
I'm currently using Sulley to fuzz my FTP server, but I'm having problems. I want to specify the STRU command, which has a syntax:
STRU [<SP> F|R|P] <CRLF>
I tried to specify the ...
1
vote
1answer
371 views
Fuzzing Android API
I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from ...
0
votes
3answers
310 views
Code auditing and/or fuzzing - Books and resources
I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
4
votes
1answer
117 views
Sulley - only using ASCII printable characters
I have a problem fuzzing FTP protocol. An example of a command fuzzed is the following data model, which should fuzz the "CWD [string]" command of the FTP protocol.
s_initialize('CWD')
...
2
votes
1answer
261 views
Can fuzzing be considered a software testing technique for any vulnerability type
I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities:
Bypass a restriction or similar
...
7
votes
3answers
1k views
What does a common workstation setup look like for pentesting and vulnerability research?
I'm a security enthusiast, and am in need of some guidance to get me into the branch. I've always been held back by lack of methodology in my research, and it tends to break down my motivation towards ...
3
votes
2answers
170 views
Software suggestions on building a “passive” and “active” WAN simulation and fuzzing device?
I want to build a more-or-less self-contained box that I can plug two or more endpoints into (routers, mainly) that will simulate a WAN. I want to be able to mess up traffic in all sorts of ways, both ...
4
votes
3answers
241 views
How should I configure OS for fuzz testing?
Should I configure my OS in any particular way, if I'm going to be doing some fuzz testing? Should I turn off ASLR (address space randomization)? Does it matter?
6
votes
1answer
242 views
How many iterations of fuzzing is enough?
Fuzzing is a convenient, relatively low-cost way to detect some kinds of vulnerabilities, particularly in C/C++ code.
My question: How much fuzzing is enough? Are there are any standards or best ...
