Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fuzzing]

Fuzzing is a testing technique that consists on passing malformed data as input to programs trying to uncover vulnerabilities in the handling of this malformed input data.

0
votes
0answers
17 views

What's a good fuzzing framework for fuzzing a local standalone GUI / network application / Browser? [on hold]

I am not newbie at exploit development , but I would like to have a solid useful fuzzing framework instead of picking every fuzzing to see if it's work.. I Have a list of fuzzing framework which I ...
-1
votes
0answers
32 views

Fuzzing of GUI based windows applications

I have been looking for some options in order to fuzz windows based GUI application. I have an application binary (exe) which has some GUI forms, first it asks for Login and demand username and ...
0
votes
0answers
37 views

Is there a protocol fuzzer or fuzzing framework that uses cryptography?

When reading about fuzzing, the way to go seems to ignore checksums and cryptographic integrity protection or at least circumvent verification procedures via a 'fuzz-friendly mode'. For black-box ...
0
votes
1answer
51 views

Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]

I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway) There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
1
vote
0answers
48 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
1
vote
1answer
27 views

Criteria for selecting fields and network protocols for fuzzing

I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification. ...
1
vote
0answers
101 views

Fuzzing of Mobile Applications

I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz. I searched on ...
1
vote
2answers
189 views

What is the importance of fuzzing?

I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need ...
1
vote
1answer
56 views

Are there other methods than fuzzing for black box?

I find fuzzing a bit to basic method if it comes to black box apps. I am specifically interested how to find a vulnerability in network protocols. I have read "Attacking Network Protocols" but only ...
2
votes
2answers
344 views

Fuzzing versus Symbolic Execution — what's the difference?

Fuzzing, per a current Wikipedia definition is defined the following way: Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random ...
-1
votes
1answer
117 views

fuzzing xss mutillidae with OWASP ZAP

I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
0
votes
1answer
102 views

SAT (Satisfiability) it is security risk?

If researcher found satisfiability in any software, this is a threat to security? If answer - "Yes", how can attacker to use SAT?
1
vote
0answers
104 views

First chance vs second chance during fuzzing in windbg

I tried to ask google and search here or at stackoverflow, but could not find the results I was looking for. Sorry if the question is a duplicate (please provide a link or hint to google it; thank you)...
1
vote
0answers
246 views

Sending a POST request with directory traversal attack

I'm trying to fuzz an embedded web server. The problem is that the API requests require a user be logged in by sending a POST request with the username and password. Without the POST request the ...
1
vote
1answer
94 views

Fuzzing: Quickly find the exact number of bytes

I'm currently practicing buffer overflow. And I have a question for you regarding fuzzing. I am able to develop a python script that will try several buffer sizes to crash an application. It works ...
0
votes
1answer
2k views

Fuzzing with Owasp-Zap

I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
0
votes
1answer
95 views

How does one exploit cross scripting?

In my computer science class, my professor provided the following example... Normally, a user would provide a link by typing the following in chatroom... [Example Website](https://example.com) And ...
9
votes
1answer
292 views

Is it worth it to fuzz Rust-written software?

If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
0
votes
1answer
1k views

Fuzzing a webserver using DirBuster

So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster ...
1
vote
0answers
56 views

Sniffing devices in a serial topology

I have the following setup: PBX Server -> Internet -> LAN -> IP Phone -> Workstation (PC) Which means that my computer is connected to the LAN, through a Dual Ethernet card on the IP ...
1
vote
0answers
52 views

How to help the automated fuzzing community?

I can see there are great tools to do automated fuzzing: https://en.wikipedia.org/wiki/Fuzzing ex.: https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) But how can a non-programmer help these ...
3
votes
1answer
185 views

Fuzzing a mips interactive binary

I need to fuzz an interactive binary (for which I do not have the source code) compiled for a MIPS architecture. It is a login console and i'd like to fuzz the interactive text provided by the user (...
1
vote
1answer
400 views

symbolic execution vs fuzzing

I think I understand the difference between fuzzing and symbolic execution especially when it comes to having a program that expects specific values (in this case symbolic execution will work and ...
2
votes
0answers
213 views

ASN.1-based network protocol fuzzer [closed]

I want to do network protocol-based fuzzing using a network protocol specified in ASN.1. After investigating the available open source tools, I need to decide between the Peach community edition, ...
1
vote
0answers
230 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
0
votes
1answer
370 views

How to preform black-box (no source) vulnerability testing/fuzzing?

How would I (or) what software would I use to conduct local application (stored on the PC) black-box (no source/closed source) fuzzing or vulnerability testing for Windows? I've just been using common ...
0
votes
3answers
241 views

Fuzzing client apps

Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the ...
0
votes
1answer
344 views

Protocol fuzzing of a java application

I need to fuzz a communication between a client-server application written in Java. Already set up a MITM (burp), so I am able to see every request. The request body is a soap-xml document where some ...
3
votes
1answer
172 views

Fuzzing authenticated part of web application

I have a web application I am wanting to fuzz. It consists of a lot of REST webservice gets/puts. I have been considering using Sulley Fuzzing Framework or its successor boofuzz. Since the jsessionid ...
4
votes
0answers
130 views

Fuzzing services? [closed]

Are there any softwares/solutions with we can just: Download, start a binary/shell script And it will automatically start to fuzz ex.: the Linux kernel, like ex.: syzkaller? But if it would found ...
1
vote
0answers
284 views

Why isn't there any Cryptocurrency for fuzzing well-known softwares?

Looks like automated fuzzing is a great idea to find security vulnerabilities, bugs: http://seclists.org/oss-sec/2017/q1/471 , ex.: syzkaller ( https://news.ycombinator.com/item?id=13705833 ) For the ...
3
votes
1answer
513 views

General techniques for identifying an unknown service

I have a specific sample I'd like feedback on, but my view is an answer about general techniques is more valuable for this site. I'll leave the details in, in case anyone googling this bumped into the ...
5
votes
2answers
1k views

OWASP ZAP FUZZ functionality not highlighted

I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords. But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint ...
2
votes
0answers
209 views

Burpsuite - CSRF Token Macro

I implemented a website using the vaadin-framework. When I send a request to my server, there is some data in my POST-Request which looks like: {"csrfToken":"3df2f528-15c7-434c-8505-539be1c44157","...
0
votes
2answers
246 views

How to investigate open firewall ports further

I scanned my friend's firewall (Zyxel SBG3500-N) with NMAP and I found some undocumented ports open with services: 8888 tcp open http syn-ack lighttpd 1.4.34 18443 tcp open http syn-ack ...
1
vote
0answers
606 views

Fuzzing an iPhone

I'm currently researching how to fuzz Apple devices (specifically an iPhone 4 and an iPad 2). The devices are placed into DFU mode and then accessed using OpeniBoot. I've read through a good chunk of ...
0
votes
1answer
127 views

Error running NodeFuzz [closed]

I have been trying to fuzz chromium with NodeFuzz. I have followed this website http://jultika.oulu.fi/files/nbnfioulu-201504161396.pdf . Here is my error Loading default configuration-file: ./...
1
vote
2answers
850 views

Vulnerability scanning vs fuzzing a web application

In the context of web applications, is vulnerability scanning a form of fuzzing? I was told it wasn't the case, but here's what I know: Wikipedia defines fuzzing as "providing invalid, unexpected, ...
3
votes
1answer
66 views

Sulley - Logic behind primitives

Are sulley's primitives used to build a description of the protocol or to specify what kind of data we want to generate? Let's take for instance the following primitive s_string("ok", encoding="ascii"...
1
vote
0answers
271 views

Linux service on UDP ports under MITM or fuzzing attack

I am rather new to this forum but I will try my best to explain my situation. I run a game server for an outdated game called Project Reality. The community is rather small and the remaining servers ...
1
vote
1answer
480 views

Fuzzing C++ application that expects XML file

I'm trying to fuzz an application to make sure it is secure. The app does not have any UI and needs to be run via the cmdline: app.exe myfile.xml Also myfile.xml looks like this: <Sample> <...
1
vote
1answer
274 views

Does fuzz testing produce different output compared to manual testing?

I am testing an API and one parameter is vulnerable to SQL injection. When I run OWASP ZAP's fuzzer on this parameter, the input "; or 1=1" results in a successful exploit of SQL injection. However, ...
5
votes
0answers
443 views

How could I train a ML system to identify vulnerabilities in code? [closed]

Apologies if this is not as much of a "question" as it is a discussion. I've been thinking about this for a while. How could I train a machine learning system to identify (new) vulnerabilities in ...
4
votes
3answers
3k views

I want to start learning fuzzing windows applications, where should I start?

I got my B.Sc. in computer science and I am familiar with basic assembly language. I want to start learning about how to find vulnerabilities in Windows applications, e.g. buffer overflows, use-after-...
4
votes
2answers
397 views

What kind of bugs can be found by dumb fuzzing a desktop app?

I'm just starting out to learn about fuzzing and have made a dumb fuzzer that changes several random bytes in a pdf file to random values, opens it and detects if Acrobat Reader has crashed. What ...
1
vote
0answers
239 views

Parsing/processing Burpsuite Intruder responses automatically?

So, testing some command injection fuzzing in Burp using Intruder, and each of the responses generated are around 10k with 99.5% of them being identical between each request. Is there a way to ...
5
votes
2answers
429 views

How to see results of protocol fuzzing

Had a class today about protocol fuzzing whereby my professor explained fuzzing in a lot of detail, but neglected to explain how someone would actually measure a fuzzing process. So how would you ...
1
vote
2answers
29 views

Assuming existence of sufficient number of benign inputs?

I have come across multiple machine learning based security solutions that train their detectors/models using "benign" inputs. The assumption is that the operator has access to sufficiently exhaustive ...
2
votes
1answer
213 views

Run fuzzer on any service or process in Linux

I have seen examples of fuzzers to submit different inputs to some application or port. How can we run fuzzers on services or processes like any background process for any application? Any ideas or ...
0
votes
1answer
289 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?