Questions tagged [fuzzing]
Fuzzing is a testing technique that consists on passing malformed data as input to programs trying to uncover vulnerabilities in the handling of this malformed input data.
102
questions
0
votes
0
answers
26
views
In what use case would Mutational and Feedback fuzzing be used in?
I am currently working on an assignment paper that asks how each type of fuzzing would work and in what use case they would be used.
I defined Feedback as a tool that would throw inputs which would ...
- 111
1
vote
1
answer
93
views
Unlisted directory discovery of a web server without using bruteforce attacks
Some creator I support on SubscribeStar hosts their files on a dedicated AWS web storage server of theirs and the names are easily accessible and sometimes guessable without any kind of security or ...
- 111
0
votes
0
answers
71
views
Is Reading Windows Reserved Filenames Through a URL Valid for OS Enumeration?
I'm aware that writing a file with a reserved name such as CON.txt or CON.mp3, aux.txt, lpt1.html, etc. is not allowed by Windows and can be leveraged for enumeration.
However, what about reading a ...
0
votes
1
answer
299
views
Zap: How to export Fuzzer results/report with the Request and Response?
I'm relatively new to using OWASP ZAP. I tried fuzzing POST requests with Zap and am able to see all the messages sent in the Fuzzer tab.
When I select one of the messages in the Fuzzer tab, I can see ...
- 103
-2
votes
1
answer
444
views
What is the relationship between fuzzing and buffer overflow? Does fuzzing leads to buffer overflow? [duplicate]
What is the relationship between fuzzing and buffer overflow and does fuzzing leads to buffer overflow? Is buffer overflow a subset of fuzzing?
0
votes
0
answers
25
views
Zero day vulnerabilities & Cybersecurity Supply Chain Risk Management - how to move from a reactive posture to a proactive posture? [duplicate]
I refer to the Log4j logging framework vulnerability - Source: https://www.wired.com/story/log4j-flaw-hacking-internet/
Since software vulnerabilities is an inevitable part of life, and speed is of an ...
0
votes
1
answer
117
views
Is there a term for a non-brute-force version of a fuzzer?
Thinking of how a fuzzer brute-forces a lot of input to a program to discover vulnerabilities, it seems natural that one would then consider the concept of writing a program that analyzes the target ...
- 1,310
0
votes
0
answers
120
views
Find configured domains accepted by a reverse proxy
Context
I am playing around with a machine from hack the box. I found what appears to be a squid v. 4.6 listening on port 3128. None of my requests works
< HTTP/1.1 400 Bad Request
< Server: ...
- 111
-1
votes
1
answer
2k
views
How can I fuzz a http server? [closed]
I was researching fuzzing using AFL and hongofuzz and they mainly support applications that run in the terminal. After that I came across a list of resources for network fuzzers, and found afl-net ...
0
votes
0
answers
218
views
How to fuzz restricted shell?
I want to fuzz the restricted shell which is customized linux shell. I can only run certain commands which are specific to application. OS commands are not allowed to run. The shell looks as below ...
- 1
0
votes
0
answers
247
views
Fuzzer Mutators Packages for Python
I am creating a network fuzzer in Python and I have a debate about using open-source mutators or create my custom mutator. The fuzzing target is proprietary network protocols. What I am looking for is ...
- 13
14
votes
2
answers
3k
views
Is a crash always exploitable for RCE?
Reading papers written by teams looking for vulnerabilities using fuzzing, I notice that many people label a crash as a DoS vulnerability. While in other papers and researches, they go deeper after ...
- 65
1
vote
2
answers
4k
views
How do I pass a list of cookies to Wfuzz?
I know that you can pass cookies in Wfuzz by using multiple -b parameters like so: wfuzz -w /path/to/wordlist -b cookie1=foo -b cookie2=bar http://example.com/FUZZ
but I am wondering if you can pass ...
- 23
1
vote
1
answer
176
views
What is the way to know that the endpoint is down if there is an L4 / L7 balancer?
I'm writing an API-fuzzer and I want to detect if a sequence cause falling down of an endpoint of some service. Of course I can get 500 response code, but it's may be called from code of an endpoint. ...
- 11
0
votes
1
answer
273
views
Adding Floating point operations to fuzzing?
During analysing a software testing paper I read
We plan to add floating-point operations in order to extend fuzz testing capability.
What kind of benefits I can expect from adding floating point ...
- 31
2
votes
0
answers
145
views
Analyzing binary by ZZUF and PEACH fuzzers
I have installed two different fuzzer ZZUF and PEACH fuzzers. Unfortunately, my lack of knowledge I could not test C++ binaries by both fuzzers. Testing binaries process is not given PEACH and ZZUF ...
- 31
-1
votes
1
answer
317
views
Fuzzing with a Quantum computer? [closed]
Are there any projects, solutions, ideas where it is possible to fuzz a software:
https://en.wikipedia.org/wiki/Fuzzing
using quantum computers, quantum programming?
https://en.wikipedia.org/wiki/...
- 141
0
votes
1
answer
225
views
Is software fuzzing safe?
Is software fuzzing safe (Anerican fuzzy lop or AFL for example)? What's its probability of producing a random input that can make the program
Delete a file or
Connect to a random server
into a ...
- 11
1
vote
1
answer
218
views
Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]
I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway)
There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
- 11
1
vote
0
answers
515
views
Android Exploit Development Lab [closed]
Looking to setup an exploit development environment to do the following:
Fuzz Android libraries to find new vulnerabilities
Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
- 111
1
vote
1
answer
97
views
Criteria for selecting fields and network protocols for fuzzing
I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification.
...
- 145
1
vote
0
answers
400
views
Fuzzing of Mobile Applications
I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz.
I searched on ...
- 191
2
votes
2
answers
449
views
What is the importance of fuzzing?
I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need ...
- 136
1
vote
1
answer
144
views
Are there other methods than fuzzing for black box?
I find fuzzing a bit to basic method if it comes to black box apps. I am specifically interested how to find a vulnerability in network protocols. I have read "Attacking Network Protocols" but only ...
5
votes
2
answers
4k
views
Fuzzing versus Symbolic Execution -- what's the difference?
Fuzzing, per a current Wikipedia definition is defined the following way:
Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random ...
- 265
-1
votes
1
answer
506
views
fuzzing xss mutillidae with OWASP ZAP
I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
0
votes
1
answer
176
views
SAT (Satisfiability) it is security risk?
If researcher found satisfiability in any software, this is a threat to security? If answer - "Yes", how can attacker to use SAT?
- 113
1
vote
0
answers
443
views
First chance vs second chance during fuzzing in windbg
I tried to ask google and search here or at stackoverflow, but could not find the results I was looking for. Sorry if the question is a duplicate (please provide a link or hint to google it; thank you)...
- 11
1
vote
0
answers
756
views
Sending a POST request with directory traversal attack
I'm trying to fuzz an embedded web server. The problem is that the API requests require a user be logged in by sending a POST request with the username and password. Without the POST request the ...
- 21
1
vote
1
answer
305
views
Fuzzing: Quickly find the exact number of bytes
I'm currently practicing buffer overflow. And I have a question for you regarding fuzzing.
I am able to develop a python script that will try several buffer sizes to crash an application. It works ...
- 11
1
vote
1
answer
5k
views
Fuzzing with Owasp-Zap
I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
- 325
0
votes
1
answer
159
views
How does one exploit cross scripting?
In my computer science class, my professor provided the following example...
Normally, a user would provide a link by typing the following in chatroom...
[Example Website](https://example.com)
And ...
- 153
9
votes
1
answer
457
views
Is it worth it to fuzz Rust-written software?
If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
- 93
0
votes
1
answer
4k
views
Fuzzing a webserver using DirBuster
So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster ...
- 53
1
vote
0
answers
105
views
Sniffing devices in a serial topology
I have the following setup:
PBX Server -> Internet -> LAN -> IP Phone -> Workstation (PC)
Which means that my computer is connected to the LAN, through a Dual Ethernet card on the IP ...
- 2,369
1
vote
0
answers
112
views
How to help the automated fuzzing community?
I can see there are great tools to do automated fuzzing: https://en.wikipedia.org/wiki/Fuzzing
ex.: https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer)
But how can a non-programmer help these ...
- 199
3
votes
1
answer
471
views
Fuzzing a mips interactive binary
I need to fuzz an interactive binary (for which I do not have the source code) compiled for a MIPS architecture. It is a login console and i'd like to fuzz the interactive text provided by the user (...
- 63
1
vote
1
answer
623
views
symbolic execution vs fuzzing [duplicate]
I think I understand the difference between fuzzing and symbolic execution especially when it comes to having a program that expects specific values (in this case symbolic execution will work and ...
- 111
2
votes
0
answers
554
views
ASN.1-based network protocol fuzzer [closed]
I want to do network protocol-based fuzzing using a network protocol specified in ASN.1.
After investigating the available open source tools, I need to decide between the Peach community edition, ...
- 21
1
vote
0
answers
635
views
Zed Attack Proxy Fuzzer cookie handling
I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
- 111
0
votes
1
answer
743
views
How to preform black-box (no source) vulnerability testing/fuzzing?
How would I (or) what software would I use to conduct local application (stored on the PC) black-box (no source/closed source) fuzzing or vulnerability testing for Windows? I've just been using common ...
- 83
0
votes
3
answers
494
views
Fuzzing client apps
Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the ...
0
votes
1
answer
528
views
Protocol fuzzing of a java application
I need to fuzz a communication between a client-server application written in Java. Already set up a MITM (burp), so I am able to see every request. The request body is a soap-xml document where some ...
- 1
3
votes
1
answer
438
views
Fuzzing authenticated part of web application
I have a web application I am wanting to fuzz. It consists of a lot of REST webservice gets/puts. I have been considering using Sulley Fuzzing Framework or its successor boofuzz.
Since the jsessionid ...
- 133
5
votes
0
answers
186
views
Fuzzing services? [closed]
Are there any softwares/solutions with we can just:
Download, start a binary/shell script
And it will automatically start to fuzz ex.: the Linux kernel, like ex.: syzkaller?
But if it would found ...
- 531
1
vote
0
answers
374
views
Why isn't there any Cryptocurrency for fuzzing well-known softwares?
Looks like automated fuzzing is a great idea to find security vulnerabilities, bugs: http://seclists.org/oss-sec/2017/q1/471 , ex.: syzkaller ( https://news.ycombinator.com/item?id=13705833 )
For the ...
- 31
4
votes
1
answer
2k
views
General techniques for identifying an unknown service
I have a specific sample I'd like feedback on, but my view is an answer about general techniques is more valuable for this site. I'll leave the details in, in case anyone googling this bumped into the ...
- 4,823
6
votes
2
answers
2k
views
OWASP ZAP FUZZ functionality not highlighted
I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords.
But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint ...
- 61
2
votes
0
answers
356
views
Burpsuite - CSRF Token Macro
I implemented a website using the vaadin-framework. When I send a request to my server, there is some data in my POST-Request which looks like:
{"csrfToken":"3df2f528-15c7-434c-8505-539be1c44157","...
- 161
0
votes
2
answers
502
views
How to investigate open firewall ports further
I scanned my friend's firewall (Zyxel SBG3500-N) with NMAP and I found some undocumented ports open with services:
8888 tcp open http syn-ack lighttpd 1.4.34
18443 tcp open http syn-ack ...
- 29