1

In the context of web applications, is vulnerability scanning a form of fuzzing?

I was told it wasn't the case, but here's what I know:

  • Wikipedia defines fuzzing as "providing invalid, unexpected, or random data to the inputs of a computer program."
  • Web application vulnerability scanners send invalid, unexpected data to identify vulnerabilities like SQL injections or cross site scripting.
Improve this question
5
  • Hint: read the description of the tags you used for the question...
    – user83938
    May 29, 2016 at 15:10
  • you have the last two nouns in your first sentence backwards, and then the answer is "yes".
    – dandavis
    May 29, 2016 at 15:19
  • 1
    @dandavis "... a fuzzing of form"? ^^
    – user83938
    May 29, 2016 at 15:26
  • 2
    heh; dan needs more coffee! it should say "is fuzzing a form of vulnerability scanning?" yes.
    – dandavis
    May 29, 2016 at 15:40
  • Sorry english is not my native language. My question was probably not well written. Simply put, in order to identify vulnerabilities, vulnerability scanners send various inputs like ', ' AND '1'='2, <script>alert<script>. Can this be called fuzzing?
    – Othman
    May 29, 2016 at 15:50

2 Answers 2

Reset to default
5

The idea of fuzzing is to send data to the interface with not much intelligence: garbage, random input and so on. When you are using a vulnerability scanner, you usually test for well known problems. In the case of web applications: injections and so on. It is possible that a vulnerability scanner can include some sort of fuzzing as one of the tests it performs.

Improve this answer
0

Fuzzing is a form of vulnerability testing. But vulnerability testing is not necessary a form of fuzzing. Some vulnerability scanners might use fuzzing techniques, modules or plugins to do so. For example Nessus has the following plugins to approach "unknown" issues in web applications (source):

  • 44967: CGI Generic Command Execution Vulnerability (time based)
  • 44136: CGI Generic Cookie Injection Scripting
  • 44135: Web Server Generic Cookie Injection
  • 44134: CGI Generic Unseen Parameters Discovery
  • 43160: CGI Generic SQL Injection (blind, time based)
  • 42872: CGI Generic Local File Inclusion Vulnerability (2nd pass)
  • 42479: CGI Generic SQL Injection Vulnerability (2nd pass)
  • 42427: CGI Generic SQL Injection Vulnerability (HTTP Headers)
  • 42426: CGI Generic SQL Injection Vulnerability (HTTP Cookies)
  • 42425: CGI Generic Persistent Cross-Site Scripting Vulnerability
  • 42424: CGI Generic SQL Injection (blind)
  • 42423: CGI Generic SSI Injection Vulnerability
  • 42056: CGI Generic Local File Inclusion Vulnerability
  • 42055: CGI Generic Format String Vulnerability
  • 42054: CGI Generic SSI Injection Vulnerability
  • 39469: CGI Generic Remote File Inclusion Vulnerability
  • 39468: CGI Generic Header Injection Vulnerability
  • 39467: CGI Generic Path Traversal Vulnerability
  • 39465: CGI Generic Command Execution Vulnerability
  • 11139: CGI Generic SQL Injection Vulnerability

This helps to determine issues which are not covered by other plugins based on derivative techniques, fingerprinting mechanism or channeled exploit approaches.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .