Lecture 14

Question 1

What is fuzzing?

Answer 1

Automated software testing technique. Premise Automatically generate input data for an application. Monitor the result of feeding the data to the application. If an unexpected result is obtained thats a bug.

Question 2

What is mutation based fuzzing?

Answer 2

User supplies one or many well formed inputs
Create mutations of the well formed inputs
Assumes that variations of the well formed input may be problematic
Mutations may be completely random or follow some heuristic
Requires little to no set up time
Dependent on the inputs being modified
May fail for protocols with checksums, those which depend on challenge
response, etc.
Example Tools:
Taof, GPF, ProxyFuzz, Peach Fuzzer, etc.

Question 3

What is generation based fuzzing?

Answer 3

Test cases are generated from some description of the format: RFC,
documentation, expert knowledge, etc.
Anomalies are added to each possible spot in the inputs
Knowledge of protocol should give better results than random fuzzing
Can take significant time to set up
Examples
SPIKE, Sulley, Mu-4000, Codenomicon, Peach Fuzzer, etc…