0

Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the products created by my company. My company produces non-web based products that are installed on each customer's local machine to be used by the customer. These client apps connect to the intranet or internet for functioning, but they are non-browser based.

My problem is, I did not find any information about if fuzzing these apps is possible.

What is fuzzing?

  • 2
    Fuzzing is a term of testing. Basically 'throwing' things at the app and seeing what impact happens. How this is done depends on the app, which I can't in your case comment on. It makes no difference what the app is developed in. It might be worth looking at fuzz testing and what it involves, you will struggle to do it efficiently if you don't understand the concepts of what you are testing. A fuzz testing app can help, but you need to understand the output and what (if any) action is needed. Good luck on your quest :) – ISMSDEV Jul 11 '17 at 17:36
1

Is it possible to file fuzz and network fuzz client apps written in C# .Net?

Yes, it is possible.

What is fuzzing?

It is a way to test apps by feeding them random data. Accordingly file fuzz is option for testing by random files and network fuzz is testing apps by random data and/or files over the network.

0

Wikipedia article on fuzzing:

https://en.wikipedia.org/wiki/Fuzzing

OWASP article on fuzzing:

https://www.owasp.org/index.php/Fuzzing

Basically it's feeding random, unexpected data to the application and monitoring if anything, that should not happen, happens (most common - application crashes). It is possible to fuzztest any application that has input fields.

This is an automated method and if you're not provided with appropriate tools by your company, I recommend you checking the "Fuzzing tools" section in the OWASP article I linked above, likely you will find something that suits your case.

0

You can try Spike or any other fuzzer on the port or any interface, that will be a start, can check if its trying to access any files or data or dll that it should not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.