I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or help will be appreciated.
Generally the goal of a fuzzer is to present an application with a variety of inputs through it's expected input sources and then measure how it responds. I'm not sure there's value in fuzzing with the memory of a running application and then seeing what happens.
Interesting, possibly, but not valuable from a security point of view.
If the threat scenario you're concerned about has an attacker in position to read or manipulate application memory then input validation or bounds checking for that application is the least of your worries.
I would focus fuzzing on the standard input channels for your application. For example if you're examining a web browser I would focus on these input channels:
- Local system files (html pages or media)
- Html content returned from a server (html pages)
- Media content returned from a server (video, flash, images)
- Input to the navigation bar
My guess is that if you scramble the memory of a running process it's probably just going to crash and I'm not sure if that tells you anything useful.