OWASP Testing Guide Appendix C: Fuzz Vectors - Revision history

Jane O'Connor: Final edit

2014-05-14T10:17:07Z

Final edit

Amro Ahmed at 04:03, 17 February 2013

2013-02-17T04:03:06Z

Amro Ahmed at 01:48, 17 February 2013

2013-02-17T01:48:18Z

Amro Ahmed at 01:47, 17 February 2013

2013-02-17T01:47:32Z

Amro Ahmed at 01:47, 17 February 2013

2013-02-17T01:47:06Z

Mmeucci at 16:49, 17 October 2012

2012-10-17T16:49:27Z

KirstenS: /* Buffer Overflows (BFO) */

2008-12-15T22:04:20Z

‎Buffer Overflows (BFO)

KirstenS: /* XPATH Injection */

2008-12-15T21:44:25Z

‎XPATH Injection

KirstenS: /* XML Injection */

2008-12-15T00:43:30Z

‎XML Injection

KirstenS: /* LDAP Injection */

2008-12-15T00:13:51Z

‎LDAP Injection

@@ Line 3: / Line 3: @@
 The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], [[ZAP]] or another fuzzer.
-Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
+Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing. This is the simple part of the discovery phase. Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.
 This is the simple part of the discovery phase.
 === Fuzz Categories ===
@@ Line 13: / Line 12: @@
 * Recursive fuzzing
 * Replacive fuzzing
 We examine and define each category in the sub-sections that follow.
 ==== Recursive fuzzing ====
@@ Line 24: / Line 25: @@
 </pre>
-Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
+Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet (i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f}) falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
 <pre>
 <nowiki>http://www.example.com/00000000</nowiki>
@@ Line 32: / Line 33: @@
 <nowiki>http://www.example.com/ffffffff</nowiki>
 </pre>
 ==== Replacive fuzzing ====
@@ Line 40: / Line 42: @@
 <nowiki>http://www.example.com/8302fa3b</nowiki>
 </pre>
 Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors:
@@ Line 48: / Line 51: @@
 </pre>
-This is a form of replacive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified.
+This is a form of replacive fuzzing. In this category, the total number of requests is dependent on the number of fuzz vectors specified.
 The remainder of this appendix presents a number of fuzz vector categories.
 === Cross Site Scripting (XSS) ===
@@ Line 78: / Line 83: @@
   <nowiki><IMG SRC="jav&amp;#x0A;ascript:alert(<WBR>'XSS');"></nowiki>
   <nowiki><IMG SRC="jav&amp;#x0D;ascript:alert(<WBR>'XSS');"></nowiki>
 === Buffer Overflows and Format String Errors ===
@@ Line 83: / Line 89: @@
 ==== Buffer Overflows (BFO) ====
 A buffer overflow or memory corruption attack is a programming condition which allows overflowing of valid data beyond its prelocated storage limit in memory.
 For details on Buffer Overflows: [[Testing for Buffer Overflow (OWASP-DV-014) | Testing for Buffer Overflow ]]
 Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.
@@ Line 100: / Line 108: @@
   <nowiki>A x 8193</nowiki>
   <nowiki>A x 12288</nowiki>
 ==== Format String Errors (FSE) ====
-Format string attacks are a class of vulnerabilities which involve supplying language specific format tokens in order to execute arbitrary code or crash a program. Fuzzing for such errors has as an objective to check for unfiltered user input.
+Format string attacks are a class of vulnerabilities that involve supplying language specific format tokens to execute arbitrary code or crash a program. Fuzzing for such errors has as an objective to check for unfiltered user input.
 An excellent introduction on FSE can be found in the USENIX paper entitled: [http://research.microsoft.com/pubs/74359/01-shankar.pdfl Detecting Format String Vulnerabilities with Type Qualifiers]
 Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.
@@ Line 127: / Line 138: @@
   <nowiki>%s x 129</nowiki>
   <nowiki>%x x 257</nowiki>
 ==== Integer Overflows (INT) ====
@@ Line 144: / Line 156: @@
   <nowiki>0x10000</nowiki>
   <nowiki>0x100000</nowiki>
 === SQL Injection ===
 This attack can affect the database layer of an application and is typically present when user input is not filtered for SQL statements.
 For details on Testing SQL Injection: [[Testing for SQL Injection (OWASP-DV-005)|Testing for SQL Injection]]
 SQL Injection is classified in the following two categories, depending on the exposure of database information (passive) or the alteration of database information (active).
@@ Line 156: / Line 171: @@
 * Active SQL Injection
-Active SQL Injection statements can have a detrimental effect on the underllying database if successfully executed.
 ==== Passive SQL Injection (SQP) ====
@@ Line 215: / Line 232: @@
   <nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki>
   <nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki>
 ==== Active SQL Injection (SQI) ====
@@ Line 228: / Line 246: @@
   <nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70)
   + char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki>
 === LDAP Injection ===
@@ Line 253: / Line 272: @@
   <nowiki>admin*)((|userPassword=*)</nowiki>
   <nowiki>*)(uid=*))(|(uid=*</nowiki>
 === XPATH Injection ===
@@ Line 268: / Line 288: @@
   <nowiki>count(/child::node())</nowiki>
   <nowiki>x'+or+name()='username'+or+'x'='y</nowiki>
 === XML Injection ===

@@ Line 105: / Line 105: @@
 Format string attacks are a class of vulnerabilities which involve supplying language specific format tokens in order to execute arbitrary code or crash a program. Fuzzing for such errors has as an objective to check for unfiltered user input.
-An excellent introduction on FSE can be found in the USENIX paper entitled: [http://www.usenix.net/publications/library/proceedings/sec01/full_papers/shankar/shankar_html/index.html Detecting Format String Vulnerabilities with Type Qualifiers]
+An excellent introduction on FSE can be found in the USENIX paper entitled: [http://research.microsoft.com/pubs/74359/01-shankar.pdfl Detecting Format String Vulnerabilities with Type Qualifiers]
 Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

@@ Line 2: / Line 2: @@
-The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], [[ZAP]], [[Burp Suite]] or another fuzzer.
+The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], [[ZAP]] or another fuzzer.
 Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
 This is the simple part of the discovery phase.

@@ Line 2: / Line 2: @@
-The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], [[ZAP]] [[Burp Suite]] or another fuzzer.
+The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], [[ZAP]], [[Burp Suite]] or another fuzzer.
 Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
 This is the simple part of the discovery phase.

@@ Line 2: / Line 2: @@
-The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], or another fuzzer.
+The following are fuzzing vectors which can be used with [[WebScarab]], [[JBroFuzz]], [[WSFuzzer]], [[ZAP]] [[Burp Suite]] or another fuzzer.
 Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
 This is the simple part of the discovery phase.

← Older revision		Revision as of 16:49, 17 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

@@ Line 256: / Line 256: @@
 === XPATH Injection ===
-For details on XPATH Injection: [[Testing for XPath Injection]]
+For details on XPATH Injection: [[Testing for XPath Injection (OWASP-DV-010)|Testing for XPath Injection]]
   <nowiki>'+or+'1'='1</nowiki>

@@ Line 271: / Line 271: @@
 === XML Injection ===
-Details on XML Injection here: [[Testing for XML Injection]]
+Details on XML Injection here: [[Testing for XML Injection  (OWASP-DV-008)|Testing for XML Injection]]
   <nowiki><![CDATA[<script>var n=0;while(true){n++;}</script>]]></nowiki>

@@ Line 231: / Line 231: @@
 === LDAP Injection ===
-For details on LDAP Injection: [[Testing for LDAP Injection]]
+For details on LDAP Injection: [[Testing for LDAP Injection (OWASP-DV-006)|Testing for LDAP Injection]]
   <nowiki>|</nowiki>