Open Source Fuzzing Tools (eBook)

Front Cover 1
Open Source Fuzzing Tools 2
Copyright Page 4
Contributing Authors 6
Contents 8
Chapter 1: Introduction to Vulnerability Research 11
Statement of Scope 12
Off-by-One Errors 13
Programming Language Use Errors 15
Integer Overflows 15
Bugs and Vulnerabilities 17
The Vaunted Buffer Overflow 17
Finding Bugs and Vulnerabilities 17
Source Code Review 19
Black Box Testing 20
Glass Box Testing 20
Chapter 2: Fuzzing-What's That? 21
Introduction 22
Introduction to Fuzzing 22
Milestones in Fuzzing 24
Fuzzing Technology 26
Traffic Sniffing 28
Prepared Template 29
Second-Generation Fuzzing 29
File Fuzzing 32
Host-side Monitoring 32
Vulnerability Scanners as Fuzzers 32
Uses of Fuzzing 33
Open Source Fuzzers 34
Commercial-Grade Fuzzers 34
What Comes Next 35
The Software Development Life Cycle 35
Chapter 3: Building a Fuzzing Environment 37
Introduction 38
Knowing What to Ask... 38
Basic Tools and Setup 44
Data Points 44
Crash Dumps 44
Fuzzer Output 46
Debuggers 47
Recon Tools 50
Linux 51
OSX 52
Summary 54
Chapter 4: Open Source Fuzzing Tools 55
Introduction 56
Frameworks 56
Special-Purpose Tools 58
General-Purpose Tools 62
Chapter 5: Commercial Fuzzing Solutions 65
Introduction 66
beSTORM (by Beyond Security) 66
BPS-1000 (by BreakingPoint Systems) 68
Codenomicon 69
Mu-4000 Security Analyzer (by Mu Security) 73
Chapter 6: Build Your Own Fuzzer 77
Hold Your Horses 78
Fuzzer Building Blocks 80
One or More Valid Data Sets 80
Understanding What Each Bytein the Data Set Means 81
Change the Values of the Data Sets While Maintaining the Integrity ofthe Data Being Sent 82
Recreate the Same Malformed DataSet Time and Time Again 82
An Arsenal of Malformed Values, or the Abilityto Create a Variety of Malformed Outputs 83
Maintain a Form of a State Machine 84
Summarize 85
Down to Business 85
Simplest Fuzz Testing Find Issues 98
Chapter 7: Integration of Fuzzing in the Development Cycle 101
Introduction 102
Why Is Fuzzing Important to Include in a Software Development Cycle? 103
Security Testing Workload 103
Setting Expectations for Fuzzers in a Software Development Lifecycle 111
Fuzzing as a Panacea 111
Fuzzing Tools versus ... 113
Setting the Plan for Implementing Fuzzers into a Software Development Lifecycle 113
Setting Goals 114
Building and Executing on the Plan 121
Understanding How to Increase Effectiveness of Fuzzers, and Avoiding Any Big Gotchas 125
Hidden Costs 126
Finding More Vulnerabilities 129
Summary 136
Solutions Fast Track 136
Frequently Asked Questions 140
Chapter 8: Standardization and Certification 143
Fuzzing and the Corporate Environment 144
Software Security Testing, the Challenges 144
Testing for Security 145
Fuzzing as a Viable Option 147
Business Pressure 148
Software Security Certification 149
Meeting Standards and Compliance 149
Tester Certification 150
Industry Pressure 150
Antivirus Product Testing and Certification 150
Chapter 9: What Is a File? 153
Introduction 154
Are File Fuzzers Special? 155
Analyzing and Building Files 159
Textual Files 160
Binary Files 161
Running the Test 166
Monitoring the Application with the Test Cases 171
Chapter 10: Code Coverage and Fuzzing 173
Introduction 174
Code Coverage 174
Obtaining Code Coverage 177
Instrumenting the Binary 177
Monitoring a Closed Source Application 179
Improving Fuzzing with Code Coverage 181
Manual Improvements 184
Dynamically Generating Code Coverage Improvements 191
Statically Generating Code Coverage 195
Weaknesses of Code Coverage 198
Summary 200
Solutions Fast Track 200
Frequently Asked Questions 202
Index 203