Fuzzing is the usually automated process of entering random data into a program and analyzing the results to find potentially exploitable bugs.
WHAT IS FUZZ TESTING?
In the world of cybersecurity, fuzz testing (or fuzzing) is an automated software testing technique that attempts to find hackable software bugs by randomly feeding invalid and unexpected inputs and data into a computer program in order to find coding errors and security loopholes. This is an old but increasingly common process both for hackers seeking vulnerabilities to exploit and defenders trying to find and first them fix.
Fuzz testing typically involves inputting massive amounts of random data, called fuzz, to the software or system being tested in an attempt to make it crash or break through its defenses. If a vulnerability is found, a software tool called a fuzzer can be used to identify the potential causes.
Fuzzing can often reveal serious defects that are overlooked when software is written and debugged. Fuzzers work best for discovering vulnerabilities that can be exploited by SQL injection, buffer overflow, denial of service (DOS), and cross-site scripting. These are often used by malicious hackers to disable security with the intent of either taking down a system or stealing information. Fuzz testing is less effective for dealing with security threats that do not cause program crashes, such as spyware, some viruses, worms, Trojans, and keyloggers.
How to do Fuzz Testing
The steps for fuzzy testing include the basic testing steps-
Step 1) Identify the target system
Step 2) Identify inputs
Step 3) Generate Fuzzed data
Step 4) Execute the test using fuzzy data
Step 5) Monitor system behavior
Step 6) Log defects
Examples of Fuzzers
Mutation-Based Fuzzers alter existing data samples to create new test data. This is the very simple and straightforward approach, this starts with valid samples of protocol and keeps mangling every byte or file.
Generation-Based Fuzzers define new data based on the input of the model. It starts generating input from the scratch based on the specification.
PROTOCOL-BASED-fuzzer, the most successful fuzzer is to have detailed knowledge of protocol format being tested. The understanding depends on the specification. It involves writing an array of the specification into the tool then by using model-based test generation technique go through the specification and add irregularity in the data contents, sequence, etc. This is also known as syntax testing, grammar testing, robustness testing, etc. Fuzzer can generate test cases from an existing one, or they can use valid or invalid inputs.
There are two limitations of protocol-based fuzzing:
Testing cannot proceed until the specification is mature.
Many useful protocols are an extension of published protocols. If fuzz testing is based on published specifications, Test coverage for new protocols will be limited.
The simplest form of fuzzing technique is sending random input to the software either as protocol packets or as an event. This technique of passing random input is very powerful to find bugs in many applications and services. Other techniques are also available, and it is very easy to implement. To implement these techniques we just need to change the existing inputs. We can change input just by interchanging the bits of input.
Types of bugs detected by Fuzz Testing
Assertion failures and memory leaks this methodology is widely used for large applications where bugs are affecting the safety of memory, which is a severe vulnerability.
Invalid inputIn fuzz testing, fuzzers are used to generate an invalid input which is used for testing error-handling routines, and this is important for the software which does not control its input. Simple fuzzing can be known as a way to automate negative testing.
Correctness bugsFuzzing can also be used to detect some types of “correctness” bugs. Such as a corrupted database, poor search results, etc. Fuzz Testing Tools Tools which are used in web security can widely be used in fuzz testing such as Burp Suite, Peach Fuzzer, etc.
Peach FuzzerPeach Fuzzer provides more robust and security coverage than a scanner. Other testing tools can search only for known threads whereas Peach Fuzzer enable users to find known and unknown threads.
Spike ProxyIt is a professional-grade tool looking for application-level vulnerabilities in web applications. SPIKE Proxy covers the basics, such as SQL Injection and cross-site-scripting, but it’s completely open Python infrastructure. SPIKE Proxy is available for Linux and Windows.
WebscarabWebscarab is written in Java thus portable to many platforms. For analyzing application Webscarab framework is used that communicate using HTTP and HTTPS protocols. Ex: Webscarab works as an intercepting proxy, it allows the operator to review and modify request created by the browser before they are received by the server. And allow to review and update response generated by the server before received by the browser. In this way, if web scarab finds any loophole, it will make the list of the reported issues.
OWASP WSFuzzerWSFuzzer is a GPL’d program that written in Python. GPL’d a program currently targets Web Services. In the current version of OWASPWSFuzzer HTTP based SOAP services are the main target.
Advantages of Fuzz Testing
Fuzz testing improves software Security Testing.
Bugs found in fuzzing are sometimes severe and most of the time used by hackers including crashes, memory leak, unhandled exception, etc.
If any of the bugs fail to get noticed by the testers due to the limitation of time and resources those bugs are also found in Fuzz testing.
Comments