Questions tagged [fuzzing]

Fuzzing is a testing technique that consists on passing malformed data as input to programs trying to uncover vulnerabilities in the handling of this malformed input data.

Filter by
Sorted by
Tagged with
0 votes
0 answers
38 views

Is Reading Windows Reserved Filenames Through a URL Valid for OS Enumeration?

I'm aware that writing a file with a reserved name such as CON.txt or CON.mp3, aux.txt, lpt1.html, etc. is not allowed by Windows and can be leveraged for enumeration. However, what about reading a ...
user avatar
0 votes
1 answer
36 views

Zap: How to export Fuzzer results/report with the Request and Response?

I'm relatively new to using OWASP ZAP. I tried fuzzing POST requests with Zap and am able to see all the messages sent in the Fuzzer tab. When I select one of the messages in the Fuzzer tab, I can see ...
user avatar
-2 votes
1 answer
132 views

What is the relationship between fuzzing and buffer overflow? Does fuzzing leads to buffer overflow? [duplicate]

What is the relationship between fuzzing and buffer overflow and does fuzzing leads to buffer overflow? Is buffer overflow a subset of fuzzing?
user avatar
0 votes
0 answers
23 views

Zero day vulnerabilities & Cybersecurity Supply Chain Risk Management - how to move from a reactive posture to a proactive posture? [duplicate]

I refer to the Log4j logging framework vulnerability - Source: https://www.wired.com/story/log4j-flaw-hacking-internet/ Since software vulnerabilities is an inevitable part of life, and speed is of an ...
user avatar
0 votes
1 answer
107 views

Is there a term for a non-brute-force version of a fuzzer?

Thinking of how a fuzzer brute-forces a lot of input to a program to discover vulnerabilities, it seems natural that one would then consider the concept of writing a program that analyzes the target ...
user avatar
  • 1,300
0 votes
0 answers
89 views

Find configured domains accepted by a reverse proxy

Context I am playing around with a machine from hack the box. I found what appears to be a squid v. 4.6 listening on port 3128. None of my requests works < HTTP/1.1 400 Bad Request < Server: ...
user avatar
  • 111
-1 votes
1 answer
1k views

How can I fuzz a http server? [closed]

I was researching fuzzing using AFL and hongofuzz and they mainly support applications that run in the terminal. After that I came across a list of resources for network fuzzers, and found afl-net ...
user avatar
0 votes
0 answers
114 views

How to fuzz restricted shell?

I want to fuzz the restricted shell which is customized linux shell. I can only run certain commands which are specific to application. OS commands are not allowed to run. The shell looks as below ...
user avatar
  • 1
0 votes
0 answers
174 views

Fuzzer Mutators Packages for Python

I am creating a network fuzzer in Python and I have a debate about using open-source mutators or create my custom mutator. The fuzzing target is proprietary network protocols. What I am looking for is ...
user avatar
  • 13
14 votes
2 answers
3k views

Is a crash always exploitable for RCE?

Reading papers written by teams looking for vulnerabilities using fuzzing, I notice that many people label a crash as a DoS vulnerability. While in other papers and researches, they go deeper after ...
user avatar
  • 65
1 vote
2 answers
2k views

How do I pass a list of cookies to Wfuzz?

I know that you can pass cookies in Wfuzz by using multiple -b parameters like so: wfuzz -w /path/to/wordlist -b cookie1=foo -b cookie2=bar http://example.com/FUZZ but I am wondering if you can pass ...
user avatar
  • 23
1 vote
1 answer
133 views

What is the way to know that the endpoint is down if there is an L4 / L7 balancer?

I'm writing an API-fuzzer and I want to detect if a sequence cause falling down of an endpoint of some service. Of course I can get 500 response code, but it's may be called from code of an endpoint. ...
user avatar
0 votes
1 answer
236 views

Adding Floating point operations to fuzzing?

During analysing a software testing paper I read We plan to add floating-point operations in order to extend fuzz testing capability. What kind of benefits I can expect from adding floating point ...
user avatar
  • 31
2 votes
0 answers
124 views

Analyzing binary by ZZUF and PEACH fuzzers

I have installed two different fuzzer ZZUF and PEACH fuzzers. Unfortunately, my lack of knowledge I could not test C++ binaries by both fuzzers. Testing binaries process is not given PEACH and ZZUF ...
user avatar
  • 31
-1 votes
1 answer
269 views

Fuzzing with a Quantum computer? [closed]

Are there any projects, solutions, ideas where it is possible to fuzz a software: https://en.wikipedia.org/wiki/Fuzzing using quantum computers, quantum programming? https://en.wikipedia.org/wiki/...
user avatar
0 votes
1 answer
212 views

Is software fuzzing safe?

Is software fuzzing safe (Anerican fuzzy lop or AFL for example)? What's its probability of producing a random input that can make the program Delete a file or Connect to a random server into a ...
user avatar
1 vote
1 answer
198 views

Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]

I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway) There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
user avatar
1 vote
0 answers
497 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
user avatar
  • 111
1 vote
1 answer
85 views

Criteria for selecting fields and network protocols for fuzzing

I want to test a specific device connected to different networks using fuzzing. For each network interface, there are different services listening using different protocols, with open specification. ...
user avatar
  • 145
1 vote
0 answers
356 views

Fuzzing of Mobile Applications

I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz. I searched on ...
user avatar
  • 201
2 votes
2 answers
434 views

What is the importance of fuzzing?

I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need ...
user avatar
  • 126
1 vote
1 answer
132 views

Are there other methods than fuzzing for black box?

I find fuzzing a bit to basic method if it comes to black box apps. I am specifically interested how to find a vulnerability in network protocols. I have read "Attacking Network Protocols" but only ...
user avatar
5 votes
2 answers
3k views

Fuzzing versus Symbolic Execution -- what's the difference?

Fuzzing, per a current Wikipedia definition is defined the following way: Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random ...
user avatar
-1 votes
1 answer
436 views

fuzzing xss mutillidae with OWASP ZAP

I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
user avatar
0 votes
1 answer
168 views

SAT (Satisfiability) it is security risk?

If researcher found satisfiability in any software, this is a threat to security? If answer - "Yes", how can attacker to use SAT?
user avatar
1 vote
0 answers
397 views

First chance vs second chance during fuzzing in windbg

I tried to ask google and search here or at stackoverflow, but could not find the results I was looking for. Sorry if the question is a duplicate (please provide a link or hint to google it; thank you)...
user avatar
1 vote
0 answers
665 views

Sending a POST request with directory traversal attack

I'm trying to fuzz an embedded web server. The problem is that the API requests require a user be logged in by sending a POST request with the username and password. Without the POST request the ...
user avatar
1 vote
1 answer
235 views

Fuzzing: Quickly find the exact number of bytes

I'm currently practicing buffer overflow. And I have a question for you regarding fuzzing. I am able to develop a python script that will try several buffer sizes to crash an application. It works ...
user avatar
  • 11
1 vote
1 answer
5k views

Fuzzing with Owasp-Zap

I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
user avatar
0 votes
1 answer
152 views

How does one exploit cross scripting?

In my computer science class, my professor provided the following example... Normally, a user would provide a link by typing the following in chatroom... [Example Website](https://example.com) And ...
user avatar
  • 143
9 votes
1 answer
428 views

Is it worth it to fuzz Rust-written software?

If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
user avatar
0 votes
1 answer
4k views

Fuzzing a webserver using DirBuster

So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster ...
user avatar
  • 53
1 vote
0 answers
100 views

Sniffing devices in a serial topology

I have the following setup: PBX Server -> Internet -> LAN -> IP Phone -> Workstation (PC) Which means that my computer is connected to the LAN, through a Dual Ethernet card on the IP ...
user avatar
  • 2,329
1 vote
0 answers
106 views

How to help the automated fuzzing community?

I can see there are great tools to do automated fuzzing: https://en.wikipedia.org/wiki/Fuzzing ex.: https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) But how can a non-programmer help these ...
user avatar
  • 199
3 votes
1 answer
426 views

Fuzzing a mips interactive binary

I need to fuzz an interactive binary (for which I do not have the source code) compiled for a MIPS architecture. It is a login console and i'd like to fuzz the interactive text provided by the user (...
user avatar
  • 63
1 vote
1 answer
593 views

symbolic execution vs fuzzing [duplicate]

I think I understand the difference between fuzzing and symbolic execution especially when it comes to having a program that expects specific values (in this case symbolic execution will work and ...
user avatar
  • 111
2 votes
0 answers
486 views

ASN.1-based network protocol fuzzer [closed]

I want to do network protocol-based fuzzing using a network protocol specified in ASN.1. After investigating the available open source tools, I need to decide between the Peach community edition, ...
user avatar
  • 21
1 vote
0 answers
521 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
user avatar
0 votes
1 answer
706 views

How to preform black-box (no source) vulnerability testing/fuzzing?

How would I (or) what software would I use to conduct local application (stored on the PC) black-box (no source/closed source) fuzzing or vulnerability testing for Windows? I've just been using common ...
user avatar
  • 83
0 votes
3 answers
466 views

Fuzzing client apps

Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the ...
user avatar
0 votes
1 answer
481 views

Protocol fuzzing of a java application

I need to fuzz a communication between a client-server application written in Java. Already set up a MITM (burp), so I am able to see every request. The request body is a soap-xml document where some ...
user avatar
  • 1
3 votes
1 answer
345 views

Fuzzing authenticated part of web application

I have a web application I am wanting to fuzz. It consists of a lot of REST webservice gets/puts. I have been considering using Sulley Fuzzing Framework or its successor boofuzz. Since the jsessionid ...
user avatar
  • 133
5 votes
0 answers
181 views

Fuzzing services? [closed]

Are there any softwares/solutions with we can just: Download, start a binary/shell script And it will automatically start to fuzz ex.: the Linux kernel, like ex.: syzkaller? But if it would found ...
user avatar
1 vote
0 answers
368 views

Why isn't there any Cryptocurrency for fuzzing well-known softwares?

Looks like automated fuzzing is a great idea to find security vulnerabilities, bugs: http://seclists.org/oss-sec/2017/q1/471 , ex.: syzkaller ( https://news.ycombinator.com/item?id=13705833 ) For the ...
user avatar
4 votes
1 answer
2k views

General techniques for identifying an unknown service

I have a specific sample I'd like feedback on, but my view is an answer about general techniques is more valuable for this site. I'll leave the details in, in case anyone googling this bumped into the ...
user avatar
  • 4,773
6 votes
2 answers
2k views

OWASP ZAP FUZZ functionality not highlighted

I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords. But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint ...
user avatar
  • 61
2 votes
0 answers
333 views

Burpsuite - CSRF Token Macro

I implemented a website using the vaadin-framework. When I send a request to my server, there is some data in my POST-Request which looks like: {"csrfToken":"3df2f528-15c7-434c-8505-539be1c44157","...
user avatar
0 votes
2 answers
460 views

How to investigate open firewall ports further

I scanned my friend's firewall (Zyxel SBG3500-N) with NMAP and I found some undocumented ports open with services: 8888 tcp open http syn-ack lighttpd 1.4.34 18443 tcp open http syn-ack ...
user avatar
1 vote
0 answers
905 views

Fuzzing an iPhone

I'm currently researching how to fuzz Apple devices (specifically an iPhone 4 and an iPad 2). The devices are placed into DFU mode and then accessed using OpeniBoot. I've read through a good chunk of ...
user avatar
  • 11
0 votes
1 answer
170 views

Error running NodeFuzz [closed]

I have been trying to fuzz chromium with NodeFuzz. I have followed this website http://jultika.oulu.fi/files/nbnfioulu-201504161396.pdf . Here is my error Loading default configuration-file: ./...
user avatar