FUZZING
Master One of Today’s Most Powerful Techniques for Revealing Security Flaws!
Fuzzing has evolved into one of today’s most effective approaches to test software security. To “fuzz,†you attach a program’s inputs to a source of random data, and then systematically identify the failures that arise. Hackers have
relied on fuzzing for years: Now, it’s your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.
Â
Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:
Â
• Why fuzzing simplifies test design and catches flaws other methods miss
• The fuzzing process: from identifying inputs to assessing “exploitabilityâ€
• Understanding the requirements for effective fuzzing
• Comparing mutation-based and generation-based fuzzers
• Using and automating environment variable and argument fuzzing
• Mastering in-memory fuzzing techniques
• Constructing custom fuzzing frameworks and tools
• Implementing intelligent fault detection
Â
Attackers are already using fuzzing. You should, too. Whether you’re a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.
Â
Foreword    xix
Preface       xxi
Acknowledgments xxv
About the Author  xxvii
P ARTIÂ Â Â Â Â Â Â Â B ACKGROUNDÂ Â Â Â 1
Chapter 1   Vulnerability Discovery Methodologies 3
Chapter 2   What Is Fuzzing?  21
Chapter 3   Fuzzing Methods and Fuzzer Types    33
Chapter 4   Data Representation and Analysis       45
Chapter 5   Requirements for Effective Fuzzing     61
P ART IIÂ Â Â Â Â T ARGETS AND A UTOMATIONÂ Â Â Â Â Â Â Â Â 71
Chapter 6   Automation and Data Generation       73
Chapter 7Â Â Â Environment Variable and Argument Fuzzing 89
Chapter 8Â Â Â Environment Variable and Argument Fuzzing: Automation 103
Chapter 9   Web Application and Server Fuzzing    113
Chapter 10 Web Application and Server Fuzzing: Automation   137
Chapter 11 File Format Fuzzing        169
Chapter 12Â File Format Fuzzing: Automation on UNIXÂ Â Â Â 181
Chapter 13 File Format Fuzzing: Automation on Windows        197
Chapter 14 Network Protocol Fuzzing        223
Chapter 15Â Network Protocol Fuzzing: Automation on UNIXÂ Â Â Â 235
Chapter 16 Network Protocol Fuzzing: Automation on Windows        249
Chapter 17 Web Browser Fuzzing     267
Chapter 18 Web Browser Fuzzing: Automation    283
Chapter 19 In-Memory Fuzzing        301
Chapter 20 In-Memory Fuzzing: Automation        315
P ART IIIÂ Â Â A DVANCED F UZZING T ECHNOLOGIESÂ Â Â Â Â 349
Chapter 21 Fuzzing Frameworks      351
Chapter 22 Automated Protocol Dissection 419
Chapter 23 Fuzzer Tracking    437
Chapter 24Â Intelligent Fault Detection 471
P ART IVÂ Â Â Â L OOKING F ORWARDÂ Â Â 495
Chapter 25 Lessons Learned   497
Chapter 26 Looking Forward   507
Index 519
Â
Â
