Questions tagged [fuzzing]

Fuzzing is a testing technique that consists on passing malformed data as input to programs trying to uncover vulnerabilities in the handling of this malformed input data.

Filter by
Sorted by
Tagged with
0
votes
0answers
46 views

Fuzzer Mutators Packages for Python

I am creating a network fuzzer in Python and I have a debate about using open-source mutators or create my custom mutator. The fuzzing target is proprietary network protocols. What I am looking for is ...
14
votes
2answers
3k views

Is a crash always exploitable for RCE?

Reading papers written by teams looking for vulnerabilities using fuzzing, I notice that many people label a crash as a DoS vulnerability. While in other papers and researches, they go deeper after ...
1
vote
1answer
114 views

How do I pass a list of cookies to Wfuzz?

I know that you can pass cookies in Wfuzz by using multiple -b parameters like so: wfuzz -w /path/to/wordlist -b cookie1=foo -b cookie2=bar http://example.com/FUZZ but I am wondering if you can pass ...
1
vote
1answer
50 views

What is the way to know that the endpoint is down if there is an L4 / L7 balancer?

I'm writing an API-fuzzer and I want to detect if a sequence cause falling down of an endpoint of some service. Of course I can get 500 response code, but it's may be called from code of an endpoint. ...
0
votes
0answers
187 views

How to make wfuzz perform a request to retrieve CSRF token to include in the main request?

How to make wfuzz perform a request to retrieve CSRF token to include in the main request? I've previously used patator, which includes the options before_url and before_fgrep for performing a ...
0
votes
1answer
108 views

Adding Floating point operations to fuzzing?

During analysing a software testing paper I read We plan to add floating-point operations in order to extend fuzz testing capability. What kind of benefits I can expect from adding floating point ...
2
votes
0answers
49 views

Analyzing binary by ZZUF and PEACH fuzzers

I have installed two different fuzzer ZZUF and PEACH fuzzers. Unfortunately, my lack of knowledge I could not test C++ binaries by both fuzzers. Testing binaries process is not given PEACH and ZZUF ...
-1
votes
1answer
90 views

Fuzzing with a Quantum computer? [closed]

Are there any projects, solutions, ideas where it is possible to fuzz a software: https://en.wikipedia.org/wiki/Fuzzing using quantum computers, quantum programming? https://en.wikipedia.org/wiki/...
0
votes
1answer
152 views

Is software fuzzing safe?

Is software fuzzing safe (Anerican fuzzy lop or AFL for example)? What's its probability of producing a random input that can make the program Delete a file or Connect to a random server into a ...
0
votes
0answers
43 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
1
vote
1answer
99 views

Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]

I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway) There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
1
vote
0answers
292 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
1
vote
1answer
35 views

Criteria for selecting fields and network protocols for fuzzing

I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification. ...
1
vote
0answers
207 views

Fuzzing of Mobile Applications

I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz. I searched on ...
2
votes
2answers
302 views

What is the importance of fuzzing?

I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need ...
1
vote
1answer
68 views

Are there other methods than fuzzing for black box?

I find fuzzing a bit to basic method if it comes to black box apps. I am specifically interested how to find a vulnerability in network protocols. I have read "Attacking Network Protocols" but only ...
4
votes
2answers
1k views

Fuzzing versus Symbolic Execution — what's the difference?

Fuzzing, per a current Wikipedia definition is defined the following way: Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random ...
-1
votes
1answer
224 views

fuzzing xss mutillidae with OWASP ZAP

I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
0
votes
1answer
108 views

SAT (Satisfiability) it is security risk?

If researcher found satisfiability in any software, this is a threat to security? If answer - "Yes", how can attacker to use SAT?
1
vote
0answers
204 views

First chance vs second chance during fuzzing in windbg

I tried to ask google and search here or at stackoverflow, but could not find the results I was looking for. Sorry if the question is a duplicate (please provide a link or hint to google it; thank you)...
1
vote
0answers
382 views

Sending a POST request with directory traversal attack

I'm trying to fuzz an embedded web server. The problem is that the API requests require a user be logged in by sending a POST request with the username and password. Without the POST request the ...
1
vote
1answer
126 views

Fuzzing: Quickly find the exact number of bytes

I'm currently practicing buffer overflow. And I have a question for you regarding fuzzing. I am able to develop a python script that will try several buffer sizes to crash an application. It works ...
0
votes
1answer
4k views

Fuzzing with Owasp-Zap

I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
0
votes
1answer
118 views

How does one exploit cross scripting?

In my computer science class, my professor provided the following example... Normally, a user would provide a link by typing the following in chatroom... [Example Website](https://example.com) And ...
9
votes
1answer
336 views

Is it worth it to fuzz Rust-written software?

If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
0
votes
1answer
2k views

Fuzzing a webserver using DirBuster

So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster ...
1
vote
0answers
61 views

Sniffing devices in a serial topology

I have the following setup: PBX Server -> Internet -> LAN -> IP Phone -> Workstation (PC) Which means that my computer is connected to the LAN, through a Dual Ethernet card on the IP ...
1
vote
0answers
56 views

How to help the automated fuzzing community?

I can see there are great tools to do automated fuzzing: https://en.wikipedia.org/wiki/Fuzzing ex.: https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) But how can a non-programmer help these ...
3
votes
1answer
261 views

Fuzzing a mips interactive binary

I need to fuzz an interactive binary (for which I do not have the source code) compiled for a MIPS architecture. It is a login console and i'd like to fuzz the interactive text provided by the user (...
1
vote
1answer
470 views

symbolic execution vs fuzzing [duplicate]

I think I understand the difference between fuzzing and symbolic execution especially when it comes to having a program that expects specific values (in this case symbolic execution will work and ...
2
votes
0answers
324 views

ASN.1-based network protocol fuzzer [closed]

I want to do network protocol-based fuzzing using a network protocol specified in ASN.1. After investigating the available open source tools, I need to decide between the Peach community edition, ...
1
vote
0answers
297 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
0
votes
1answer
559 views

How to preform black-box (no source) vulnerability testing/fuzzing?

How would I (or) what software would I use to conduct local application (stored on the PC) black-box (no source/closed source) fuzzing or vulnerability testing for Windows? I've just been using common ...
0
votes
3answers
324 views

Fuzzing client apps

Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the ...
0
votes
1answer
410 views

Protocol fuzzing of a java application

I need to fuzz a communication between a client-server application written in Java. Already set up a MITM (burp), so I am able to see every request. The request body is a soap-xml document where some ...
3
votes
1answer
208 views

Fuzzing authenticated part of web application

I have a web application I am wanting to fuzz. It consists of a lot of REST webservice gets/puts. I have been considering using Sulley Fuzzing Framework or its successor boofuzz. Since the jsessionid ...
5
votes
0answers
140 views

Fuzzing services? [closed]

Are there any softwares/solutions with we can just: Download, start a binary/shell script And it will automatically start to fuzz ex.: the Linux kernel, like ex.: syzkaller? But if it would found ...
1
vote
0answers
313 views

Why isn't there any Cryptocurrency for fuzzing well-known softwares?

Looks like automated fuzzing is a great idea to find security vulnerabilities, bugs: http://seclists.org/oss-sec/2017/q1/471 , ex.: syzkaller ( https://news.ycombinator.com/item?id=13705833 ) For the ...
4
votes
1answer
843 views

General techniques for identifying an unknown service

I have a specific sample I'd like feedback on, but my view is an answer about general techniques is more valuable for this site. I'll leave the details in, in case anyone googling this bumped into the ...
6
votes
2answers
2k views

OWASP ZAP FUZZ functionality not highlighted

I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords. But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint ...
2
votes
0answers
233 views

Burpsuite - CSRF Token Macro

I implemented a website using the vaadin-framework. When I send a request to my server, there is some data in my POST-Request which looks like: {"csrfToken":"3df2f528-15c7-434c-8505-539be1c44157","...
0
votes
2answers
316 views

How to investigate open firewall ports further

I scanned my friend's firewall (Zyxel SBG3500-N) with NMAP and I found some undocumented ports open with services: 8888 tcp open http syn-ack lighttpd 1.4.34 18443 tcp open http syn-ack ...
1
vote
0answers
734 views

Fuzzing an iPhone

I'm currently researching how to fuzz Apple devices (specifically an iPhone 4 and an iPad 2). The devices are placed into DFU mode and then accessed using OpeniBoot. I've read through a good chunk of ...
0
votes
1answer
134 views

Error running NodeFuzz [closed]

I have been trying to fuzz chromium with NodeFuzz. I have followed this website http://jultika.oulu.fi/files/nbnfioulu-201504161396.pdf . Here is my error Loading default configuration-file: ./...
1
vote
2answers
1k views

Vulnerability scanning vs fuzzing a web application

In the context of web applications, is vulnerability scanning a form of fuzzing? I was told it wasn't the case, but here's what I know: Wikipedia defines fuzzing as "providing invalid, unexpected, ...
3
votes
1answer
68 views

Sulley - Logic behind primitives

Are sulley's primitives used to build a description of the protocol or to specify what kind of data we want to generate? Let's take for instance the following primitive s_string("ok", encoding="ascii"...
1
vote
0answers
300 views

Linux service on UDP ports under MITM or fuzzing attack

I am rather new to this forum but I will try my best to explain my situation. I run a game server for an outdated game called Project Reality. The community is rather small and the remaining servers ...
1
vote
1answer
582 views

Fuzzing C++ application that expects XML file

I'm trying to fuzz an application to make sure it is secure. The app does not have any UI and needs to be run via the cmdline: app.exe myfile.xml Also myfile.xml looks like this: <Sample> <...
1
vote
1answer
325 views

Does fuzz testing produce different output compared to manual testing?

I am testing an API and one parameter is vulnerable to SQL injection. When I run OWASP ZAP's fuzzer on this parameter, the input "; or 1=1" results in a successful exploit of SQL injection. However, ...
5
votes
0answers
520 views

How could I train a ML system to identify vulnerabilities in code? [closed]

Apologies if this is not as much of a "question" as it is a discussion. I've been thinking about this for a while. How could I train a machine learning system to identify (new) vulnerabilities in ...