Fuzzing - Revision history

DhirajMishra: /* Added BFuzz */

2018-05-09T14:27:07Z

‎Added BFuzz

Jtpereyda: Rename Sources -> References. More generic.

2016-06-23T21:58:20Z

Rename Sources -> References. More generic.

Jtpereyda: Categorize open source fuzzers: mutational, frameworks, domain-specific; move mailing list archive to Sources

2016-06-23T21:57:52Z

Categorize open source fuzzers: mutational, frameworks, domain-specific; move mailing list archive to Sources

Jtpereyda: Add Deprecated Tools section for Untidy, which has been explicitly merged into Peach and is no longer available at its old SourceForge link

2016-06-23T21:53:08Z

Add Deprecated Tools section for Untidy, which has been explicitly merged into Peach and is no longer available at its old SourceForge link

Jtpereyda: /* Fuzzing tools */ Updating Radamsa link

2016-06-23T21:48:44Z

‎Fuzzing tools: Updating Radamsa link

Jtpereyda: lowercase boofuzz, remove extraneous info in link

2016-06-23T21:44:05Z

lowercase boofuzz, remove extraneous info in link

Jtpereyda: /* Fuzzing tools */ Add fuzzing tools: american fuzzy lop (yes it's supposed to be lowercase), Sulley, boofuzz (full disclosure: I'm behind boofuzz)

2016-06-23T21:42:31Z

‎Fuzzing tools: Add fuzzing tools: american fuzzy lop (yes it's supposed to be lowercase), Sulley, boofuzz (full disclosure: I'm behind boofuzz)

Jtpereyda: format cleanup

2016-06-03T22:58:49Z

format cleanup

Jtpereyda: /* Commercial products */ Updating Spirent link and sorting roughly by popularity

2016-06-03T22:52:56Z

‎Commercial products: Updating Spirent link and sorting roughly by popularity

Jtpereyda: Moving Peach to Commercial section. The old code is still OSS, but the corporate backer has switched to closed source.

2016-06-03T22:47:09Z

Moving Peach to Commercial section. The old code is still OSS, but the corporate backer has switched to closed source.

← Older revision		Revision as of 14:27, 9 May 2018
Line 152:		Line 152:

	[https://github.com/jtpereyda/boofuzz boofuzz]		[https://github.com/jtpereyda/boofuzz boofuzz]
		+
		+	[https://github.com/RootUp/BFuzz BFuzz]

	==== Domain-Specific Fuzzers ====		==== Domain-Specific Fuzzers ====

@@ Line 131: / Line 131: @@
 [[OWASP Testing Guide Appendix C: Fuzz Vectors]]
-== Sources ==
+== References ==
 Wikipedia article - http://en.wikipedia.org/wiki/Fuzz_testing

@@ Line 136: / Line 136: @@
 Fuzzing-related papers - http://www.threatmind.net/secwiki/FuzzingPapers
 == Fuzzing tools ==
@@ Line 141: / Line 143: @@
 === Open Source ===
 [https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) american fuzzy lop]
 [https://github.com/OpenRCE/sulley Sulley Fuzzing Framework]
 [https://github.com/jtpereyda/boofuzz boofuzz]
-[https://github.com/aoh/radamsa Radamsa - a flock of fuzzers]
+==== Domain-Specific Fuzzers ====
 [http://www.microsoft.com/download/en/details.aspx?id=21769 Microsoft SDL MiniFuzz File Fuzzer]
@@ Line 154: / Line 160: @@
 [https://github.com/nradov/abnffuzzer ABNF Fuzzer]
 === Commercial products ===

@@ Line 138: / Line 138: @@
 == Fuzzing tools ==
 [https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) american fuzzy lop]
@@ Line 148: / Line 150: @@
 [http://www.microsoft.com/download/en/details.aspx?id=21769 Microsoft SDL MiniFuzz File Fuzzer]
 [http://www.microsoft.com/download/en/details.aspx?id=20095 Microsoft SDL Regex Fuzzer]
@@ Line 157: / Line 157: @@
 [https://web.archive.org/web/20090202043027/http://www.whitestar.linuxbox.org/pipermail/fuzzing/ The fuzzing mailing list archive]
-== Commercial products ==
+=== Commercial products ===
 [http://www.codenomicon.com/products/all.shtml Codenomicon's product suite]
@@ Line 167: / Line 167: @@
 [http://www.beyondsecurity.com/bestorm_overview.html Beyond Security's beSTORM product]
 [[Category:Externally Linked Page]]

@@ Line 145: / Line 145: @@
 [https://github.com/jtpereyda/boofuzz boofuzz]
-[http://code.google.com/p/ouspg/wiki/Radamsa Radamsa - a flock of fuzzers]
+[https://github.com/aoh/radamsa Radamsa - a flock of fuzzers]
 [http://www.microsoft.com/download/en/details.aspx?id=21769 Microsoft SDL MiniFuzz File Fuzzer]

← Older revision		Revision as of 21:42, 23 June 2016
Line 138:		Line 138:

	== Fuzzing tools ==		== Fuzzing tools ==
		+
		+	[https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) american fuzzy lop]
		+
		+	[https://github.com/OpenRCE/sulley Sulley Fuzzing Framework]
		+
		+	[https://github.com/jtpereyda/boofuzz Boofuzz (Sulley fork)]

	[http://code.google.com/p/ouspg/wiki/Radamsa Radamsa - a flock of fuzzers]		[http://code.google.com/p/ouspg/wiki/Radamsa Radamsa - a flock of fuzzers]

@@ Line 1: / Line 1: @@
 ''Fuzz testing'' or ''Fuzzing'' is a Black Box software testing technique, which basically consists in finding implementation bugs using malformed/semi-malformed data injection in an automated fashion.
-== A trivial example: ==
+== A trivial example ==
 Lets's consider an integer in a program, which stores the result of a user's choice between 3 questions. When the user picks one, the choice will be 0, 1 or 2. Which makes three practical cases. But what if we transmit 3, or 255 ? We can, because integers are stored a static size variable. If the default switch case hasn't been implemented securely, the program may crash and lead to "classical" security issues: (un)exploitable buffer overflows, DoS, ...
@@ Line 23: / Line 23: @@
 Most of the fuzzers are:
-- protocol/file-format dependant
+* protocol/file-format dependant
-- data-type dependant
+* data-type dependant
 Why?
@@ Line 39: / Line 39: @@
 A fuzzer would try combinations of attacks on:
-- numbers (signed/unsigned integers/float...)
+* numbers (signed/unsigned integers/float...)
-- chars (urls, command-line inputs)
+* chars (urls, command-line inputs)
-- metadata : user-input text (id3 tag)
+* metadata : user-input text (id3 tag)
-- pure binary sequences
+* pure binary sequences
 A common approach to fuzzing is to define lists of "known-to-be-dangerous values" (''fuzz vectors'') for each type, and to inject them or recombinations.
-- for integers: zero, possibly negative or very big numbers
+* for integers: zero, possibly negative or very big numbers
-- for chars: escaped, interpretable characters / instructions (ex: For SQL Requests, quotes / commands...)
+* for chars: escaped, interpretable characters / instructions (ex: For SQL Requests, quotes / commands...)
-- for binary: random ones
+* for binary: random ones
 Please refer to [[OWASP_Testing_Guide_Appendix_C:_Fuzz_Vectors|OWASP's Fuzz Vector's resource]] for real-life fuzzing vectors examples and methodology.
@@ Line 63: / Line 63: @@
 Whatever the fuzzed system is, the attack vectors are within it's I/O. For a desktop app:
-- the UI (testing all the buttons sequences / text inputs)
+* the UI (testing all the buttons sequences / text inputs)
-- the command-line options
+* the command-line options
-- the import/export capabilities (see file format fuzzing below)
+* the import/export capabilities (see file format fuzzing below)
 For a web app: urls, forms, user-generated content, RPC requests, ...
@@ Line 81: / Line 81: @@
 One can attack:
-- the parser layer (container layer): file format constraints, structure, conventions, field sizes, flags, ...
+* the parser layer (container layer): file format constraints, structure, conventions, field sizes, flags, ...
-- the codec/application layer: lower-level attacks, aiming at the program's deeper internals
+* the codec/application layer: lower-level attacks, aiming at the program's deeper internals
 One example of file format related vulnerabilities: [http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx MS04-028] (KB833987) Microsoft's JPEG GDI+ vulnerability was a zero sized comment field, without content.
@@ Line 115: / Line 115: @@
 Recent fuzzing initiatives:
-- The [http://projects.info-pull.com/mokb/ Month of Kernel Bugs], which revealed an Apple Wireless flaw; see http://kernelfun.blogspot.com/; mainly used file system fuzzing tools
+* The [http://projects.info-pull.com/mokb/ Month of Kernel Bugs], which revealed an Apple Wireless flaw; see http://kernelfun.blogspot.com/; mainly used file system fuzzing tools
-- The [http://browserfun.blogspot.com/ Month of Browser Bugs] ([http://osvdb.org/blog/?p=127 review here]); number of bugs found: MSIE: 25 Apple Safari: 2 Mozilla: 2 Opera: 1 Konqueror: 1; used DHTML, Css, DOM, ActiveX fuzzing tools
+* The [http://browserfun.blogspot.com/ Month of Browser Bugs] ([http://osvdb.org/blog/?p=127 review here]); number of bugs found: MSIE: 25 Apple Safari: 2 Mozilla: 2 Opera: 1 Konqueror: 1; used DHTML, Css, DOM, ActiveX fuzzing tools
 == Fuzzers from OWASP ==
@@ Line 129: / Line 129: @@
 == Technical resources on OWASP  ==
-[[OWASP_Testing_Guide_Appendix_C:_Fuzz_Vectors]]
+[[OWASP Testing Guide Appendix C: Fuzz Vectors]]
 == Sources ==

@@ Line 152: / Line 152: @@
 == Commercial products ==
 [http://peachfuzzer.com Peach Fuzzing Platform]
-[http://www.spirent.com/Ethernet_Testing/Software/Studio Spirent Studio Security product suite:]
+[http://www.spirent.com/Products/AvalancheNEXT Spirent Avalanche NEXT]
-[http://www.beyondsecurity.com/bestorm_overview.html Beyond Security's beSTORM product:]
+[http://www.beyondsecurity.com/bestorm_overview.html Beyond Security's beSTORM product]
 [[Category:Externally Linked Page]]