Fuzzing is a testing technique that consists on passing malformed data as input to programs trying to uncover vulnerabilities in the handling of this malformed input data.

learn more… | top users | synonyms

1
vote
1answer
34 views

Sulley - Logic behind primitives

Are sulley's primitives used to build a description of the protocol or to specify what kind of data we want to generate? Let's take for instance the following primitive s_string("ok", encoding="ascii"...
8
votes
1answer
426 views

CERT FOE Fuzzing Framework documentation

So I read another post here about fuzzing local standalone applications. I have understood how to exploit basic buffer overflow vulnerabilities in standalone applications and am now looking on how to ...
3
votes
2answers
129 views

How to see results of protocol fuzzing

Had a class today about protocol fuzzing whereby my professor explained fuzzing in a lot of detail, but neglected to explain how someone would actually measure a fuzzing process. So how would you ...
1
vote
0answers
37 views

Fuzzing an iPhone

I'm currently researching how to fuzz Apple devices (specifically an iPhone 4 and an iPad 2). The devices are placed into DFU mode and then accessed using OpeniBoot. I've read through a good chunk of ...
1
vote
1answer
30 views

Error running NodeFuzz

I have been trying to fuzz chromium with NodeFuzz. I have followed this website http://jultika.oulu.fi/files/nbnfioulu-201504161396.pdf . Here is my error Loading default configuration-file: ./...
1
vote
2answers
99 views

I want to start learning fuzzing windows applications, where should I start?

I got my B.Sc. in computer science and I am familiar with basic assembly language. I want to start learning about how to find vulnerabilities in Windows applications, e.g. buffer overflows, use-after-...
1
vote
2answers
85 views

Vulnerability scanning vs fuzzing a web application

In the context of web applications, is vulnerability scanning a form of fuzzing? I was told it wasn't the case, but here's what I know: Wikipedia defines fuzzing as "providing invalid, unexpected, ...
0
votes
0answers
28 views

Linux service on UDP ports under MITM or fuzzing attack

I am rather new to this forum but I will try my best to explain my situation. I run a game server for an outdated game called Project Reality. The community is rather small and the remaining servers ...
1
vote
1answer
70 views

Fuzzing C++ application that expects XML file

I'm trying to fuzz an application to make sure it is secure. The app does not have any UI and needs to be run via the cmdline: app.exe myfile.xml Also myfile.xml looks like this: <Sample> &...
1
vote
1answer
60 views

Does fuzz testing produce different output compared to manual testing?

I am testing an API and one parameter is vulnerable to SQL injection. When I run OWASP ZAP's fuzzer on this parameter, the input "; or 1=1" results in a successful exploit of SQL injection. However, ...
4
votes
1answer
118 views

What kind of bugs can be found by dumb fuzzing a desktop app?

I'm just starting out to learn about fuzzing and have made a dumb fuzzer that changes several random bytes in a pdf file to random values, opens it and detects if Acrobat Reader has crashed. What ...
5
votes
0answers
40 views

How could I train a ML system to identify vulnerabilities in code? [closed]

Apologies if this is not as much of a "question" as it is a discussion. I've been thinking about this for a while. How could I train a machine learning system to identify (new) vulnerabilities in ...
1
vote
1answer
1k views

How can I fuzz standalone applications?

How can I fuzz standalone applications because I can't seem to wrap my head around how a fuzzer can "feed" fuzz data to a standalone application. Most online resources use web servers as examples. ...
1
vote
0answers
24 views

Parsing/processing Burpsuite Intruder responses automatically?

So, testing some command injection fuzzing in Burp using Intruder, and each of the responses generated are around 10k with 99.5% of them being identical between each request. Is there a way to ...
1
vote
2answers
22 views

Assuming existence of sufficient number of benign inputs?

I have come across multiple machine learning based security solutions that train their detectors/models using "benign" inputs. The assumption is that the operator has access to sufficiently exhaustive ...
2
votes
1answer
84 views

Run fuzzer on any service or process in Linux

I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
12
votes
4answers
1k views

Best way to triage crashes found via fuzzing, on Linux?

When doing fuzz testing, it is easy to end up with many bugs (many crashes). This makes it important to have a way to triage each bug that's detected, so we can prioritize them and focus our effort ...
4
votes
4answers
4k views

What's a good fuzzing framework for fuzzing a local standalone application?

I have been looking for guides and tutorials about how to fuzz and so far everything I have seen has been for web servers. If I wanted to fuzz something along the lines of calc.exe or a program that ...
0
votes
1answer
169 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?
3
votes
5answers
340 views

Why companies do not simply use hackers' tools to find their own vulnerabilities prior to the release of their software? [closed]

It may be a silly question, but hackers do use publicly-available tools to find vulnerabilities. So why don't companies, before releasing their products (Windows, Adobe etc...), use the same tools to ...
4
votes
2answers
168 views

Are there methods for determining the exploitability of bugs, after a crash is found in fuzzing?

I have found this, https://msdn.microsoft.com/en-us/magazine/cc163311.aspx It says that only "a full root-cause analysis can ensure that you have correctly diagnosed whether a given crash is ...
2
votes
1answer
314 views

Best way to do security testing for a server behind nginx proxy [closed]

I'm trying to do some security testing for my server(not a web server) which is sitting behind a nginx proxy. To start with it, I've done some fuzz testing using Sulley. As expected, most of the ...
4
votes
2answers
283 views

Fuzzing and its impact on testing environment

I asked this question on StackOverflow but got no answers so I thought that I would try my luck here since fuzzing is closely related to security and often used in vulnerability assessment tests. I'm ...
0
votes
0answers
369 views

Google Chrome Crash Report Analysis

I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though. ...
4
votes
1answer
208 views

Fuzzing of audio input vectors

A few days ago I had to make a phone call and on the other end of the line was some machine using some voice recognition software to validate the customers spoken answers to the service menu. I asked ...
3
votes
3answers
221 views

How can NSA see everything without us noticing that? [closed]

Here's one thing that keeps bugging me ever since I heard about the NSA revelations. From what I heard, NSA built a system that basically sees most of the internet, made of many subsystems which ...
0
votes
1answer
207 views

Fuzzdb detected as Trojans [closed]

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?
6
votes
1answer
2k views

Exploitability of use-after-free vulnerabilities

Use-after-free bugs are a particular class of memory safety bugs. How often are they exploitable, in practice? When you find a use-after-free bug in a program, is it often exploitable, rarely ...
13
votes
2answers
3k views

Black-box fuzzing a TCP Port running an unknown applicaiton

I'm looking for any guidance around testing a service I've found running on a target server. I'm doing a 'black-box' pen-test and the company is one of those 'I-don't-want-to-tell-you-anything' types ...
3
votes
1answer
1k views

Fuzzer causes crash. Now what?

Can anyone point me in the direction of some good tutorials regarding how to identify the type of vulnerability as reported by !exploitable and where to go from there? Essentially I've got myself a ...
3
votes
1answer
101 views

Test suite for a white-box fuzzer

I have created a white-box fuzzer by extending the Crest. Now, I'm looking for a test suite (a set of c programs with known vulnerabilities) to test the functionality of my tool. where i can find ...
4
votes
2answers
1k views

Work on fuzzing of PDF file format

What work has been done on fuzzing of the PDF file format? I'm looking for work that focuses specifically on PDF, and is aware of the PDF file format. Has there been past work that builds format-...
2
votes
1answer
163 views

Does it have sense to fuzz a ASCII file format with mutators that mess with Unicode or String Case?

I'm trying to fuzz an ASCII file format. Specifically, I'm defining some HTML5/HTML structures to be used as definition file for a smart fuzzer to fuzz web browsers. This smart fuzzer allows to ...
3
votes
1answer
329 views

Best option to fuzz a C Network Program [closed]

I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
7
votes
3answers
922 views

How to fuzz proprietary protocol over SSL?

I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
4
votes
2answers
1k views

SQL Injection - Automating the fingerprinting of the DBMS

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS. I am in ...
6
votes
1answer
9k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
1
vote
0answers
363 views

Fuzz a client with sulley [closed]

I want sulley to bind to an interface, wait for a connection and fuzz the reply to the client. How can I act as a server with sulley to fuzz a client ?
5
votes
1answer
1k views

How to fuzz on FreeFloat FTP server using SPIKE Fuzzing?

I would to seek help on using SPIKE fuzzer to fuzz an FTP server which I am testing on Freefloat FTP server but do not have idea on how to work on. As I research and tested out many different types of ...
5
votes
2answers
3k views

Fuzzing with SPIKE - the \r\n not being taken into account

I would like to fuzz FTP protocol, and currently I have the following: s_read_packet(); s_string("USER test\r\n"); s_read_packet(); s_string("PASS test\r\n"); s_read_packet(); I've also tried ...
2
votes
1answer
2k views

Fuzzing tool to find heap overflows in a Windows binary [closed]

Is there a fuzzing tool that can scan some arbitrary windows binary and identify a set of heap overflow vulnerabilities? For example, a tool that applies a set of heuristics or maybe a list of ...
7
votes
3answers
686 views

How should I compile program for fuzz testing?

I'm doing some fuzz testing of a program for which I do have source code. Should I compile the program with any particular compiler options, to make fuzz testing more effective? If so, what's the ...
8
votes
3answers
2k views

Vuln research: reverse engineering, debugging or fuzzing?

I wonder how hackers find vulnerabilities. If they use fuzzing, security engineers do it, and it's probably that security engineers (that work in a firm) have more resources than a group of hackers. ...
28
votes
4answers
6k views

What is the purpose of a fuzzer?

I've heard of these tools and from what I understand, they just send tons of random data at different services and observe their reaction to it. What is the purpose of a fuzzer? How can it be ...
7
votes
1answer
572 views

Sulley - optional element and command check

I'm currently using Sulley to fuzz my FTP server, but I'm having problems. I want to specify the STRU command, which has a syntax: STRU [<SP> F|R|P] <CRLF> I tried to specify the ...
1
vote
1answer
1k views

Fuzzing Android API

I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from ...
-1
votes
3answers
767 views

Code auditing and/or fuzzing - Books and resources

I've read the 'Shellcoder's Handbook' as well as 'The Art of Exploitation', and appreciated both a lot. Now I'm looking for additional resources delving into vulnerability spotting, code auditing, and ...
4
votes
1answer
174 views

Sulley - only using ASCII printable characters

I have a problem fuzzing FTP protocol. An example of a command fuzzed is the following data model, which should fuzz the "CWD [string]" command of the FTP protocol. s_initialize('CWD') s_static('CWD')...
3
votes
1answer
871 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
7
votes
3answers
4k views

What does a common workstation setup look like for pentesting and vulnerability research?

I'm a security enthusiast, and am in need of some guidance to get me into the branch. I've always been held back by lack of methodology in my research, and it tends to break down my motivation towards ...