The document discusses fuzz testing or fuzzing, which is a software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program to test for security vulnerabilities or crashes. It provides examples of fuzzing network protocols like HTTP and fuzzing file formats. It also discusses different types of fuzzers and provides an example of vulnerable source code and a simple fuzzing scheme to test it.

1. Fuzzing
Brute ForceVulnerability
Discovery
Khalegh Salehi
salehi@sorenasecurity.com
SSP, Sorena Secure Processing
A brief introduction on

2. About me
• Khalegh Salehi
• Software Security & Vulnerability Assessment
• http://khalegh.net
• FoxFuzzing Project
– All-In-One Full Network Protocols & File Format Fuzzing.
SSP, Sorena Secure Processing

3. Software Security Analyzing
• Static analysis:
– Approach for verifying software (including finding defects) without
executing software
• Source code vulnerability scanning tools, code inspections, etc.
• Dynamic analysis:
– Approach for verifying software (including finding defects) by
executing software on specific inputs & checking results (“oracle”)
• Functional testing, fuzz testing, etc.
• Hybrid analysis:
– Combine above approaches
• Operational:
– Tools in operational setting
• Minimize risks, report information back, etc.
• Themselves may be static, dynamic, hybrid; often dynamic
SSP, Sorena Secure Processing

4. Software Security Analyzing
• Static analysis:
– Approach for verifying software (including finding defects) without executing software
• Source code vulnerability scanning tools, code inspections, etc.
• Dynamic analysis:
– Approach for verifying software (including finding defects) by executing software on
specific inputs & checking results (“oracle”)
• Functional testing, fuzz testing, etc.
• Hybrid analysis:
– Combine above approaches
• Operational:
– Tools in operational setting
• Minimize risks, report information back, etc.
• Themselves may be static, dynamic, hybrid; often dynamic
SSP, Sorena Secure Processing
Why ?

5. SSP, Sorena Secure Processing

6. SSP, Sorena Secure Processing
I see. Let's talk on business...

7. Software Security Analyzing
• Static analysis:
– Approach for verifying software (including finding defects) without
executing software
• Source code vulnerability scanning tools, code inspections, etc.
• Dynamic analysis:
– Approach for verifying software (including finding defects) by
executing software on specific inputs & checking results (“oracle”)
• Functional testing, fuzz testing, etc.
• Hybrid analysis:
– Combine above approaches
• Operational:
– Tools in operational setting
• Minimize risks, report information back, etc.
• Themselves may be static, dynamic, hybrid; often dynamic
SSP, Sorena Secure Processing

8. Fuzzing in Wikipedia
“Fuzz testing or fuzzing is a software testing
technique, often automated or semi-automated,
that involves providing invalid, unexpected, or
random data to the inputs of computer program. The program is
then monitored for exceptions such as crashes, or failing built-in
code assertions or for finding potential memory leaks. Fuzzing is
commonly used to test for security problems in software or
computer systems. It is a form of random testing which has been
used for testing hardware or software”
SSP, Sorena Secure Processing

9. Fuzz testing history
• Fuzz testing concept from Barton Miller’s 1988
class project University of Wisconsin
– Project created “fuzzer” to test reliability of
command-line Unix programs
– Repeatedly generated random data for them until
crash/hang
– Later expanded for GUIs, network protocols, etc.
• Approach quickly found a number of defects
• Many tools & approach variations created since
SSP, Sorena Secure Processing

10. Fuzzing in brief
• A form of vulnerability analysis and testing
• Many slightly anomalous test cases are input
into the target application
• Application is monitored for any sign of error
SSP, Sorena Secure Processing

11. Fuzz testing process
SSP, Sorena Secure Processing
©softScheck

12. Fuzzing Phase
SSP, Sorena Secure Processing
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability

13. SSP, Sorena Secure Processing
Case Study

14. 14
FileFuzz
• Application vs. file type
– One file type  multiple targets
• Vendor history
– Past vulnerabilities
• High risk targets
– Default file handlers
• Windows Explorer
• Windows Registry
– Commonly traded file types
• Media files
• Office documents
• Configuration files
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
SSP, Sorena Secure Processing

15. 15
• Proprietary vs. open formats
– Vendor documents
– Wotsit.org
– Google
• Binary files
– e.g. images, video, audio, office
documents, etc.
– Headers vs. data
• Text files
– e.g. *.ini, *.inf, *.xml
– Name/value pairs
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
SSP, Sorena Secure Processing
FileFuzz

16. 16
• Binary files
– Breadth (All or Range)
• Identify potential weaknesses
FF FF FF FF 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ÿÿÿÿ..Ûþ..Å...è.
D7 FF FF FF FF 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×ÿÿÿÿ.Ûþ..Å...è.
D7 CD FF FF FF FF DB FE 0B 00 C5 00 00 01 E8 03 ; ×ÍÿÿÿÿÛþ..Å...è.
– Depth
• Determine level of
control/influence
D7 CD FD 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íýš..Ûþ..Å...è.
D7 CD FE 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íþš..Ûþ..Å...è.
D7 CD FF 9A 00 00 DB FE 0B 00 C5 00 00 01 E8 03 ; ×Íÿš..Ûþ..Å...è.
• Text Files
– name = value
file_size = 10
file_size = AAAAA
file_size = AAAAAAAAAA
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
SSP, Sorena Secure Processing
FileFuzz

17. 17
• Command line arguments
– Windows explorer
• Tools…Folder Options…File
Types
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
SSP, Sorena Secure Processing
FileFuzz

18. 18
• Visual
– Error messages
– Blue screen
• Event logs
– System logs
– Application logs
• Debuggers
• Return codes
• Debugging API
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
SSP, Sorena Secure Processing
FileFuzz

19. 19
• Execute
– Automated and repeated
• Monitor
– Library - libdasm
– Capture
• Memory location
• Registry values
• Exception type
• Kill
– Set timeout
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
[*] "crash.exe" "C:Program FilesWordPerfect Office
12ProgramsUA120.exe" 2000 /qt c:fuzzast8.ast
[*] Access Violation
[*] Exception caught at 00403f06 mov eax,[eax+edi*4]
[*] EAX:0014b1b8 EBX:00000005 ECX:00435c00 EDX:0012fbac
[*] ESI:00435c00 EDI:cccccccc ESP:0012fab8 EBP:0012fae8
SSP, Sorena Secure Processing
FileFuzz

20. 20
• Skills
– Disassembly ,Debugging
• Vulnerability types
– Stack, Heap overflow, Integer handling,
etc.
• Overflows
• Signedness
– DoS
• Out of bounds reads
• Infinite loops
• NULL pointer dereferences
– Logic errors
• Windows WMF vulnerability (MS06-001)
– Format strings, Race conditions
Identify target
Identify inputs
Generate fuzzed data
Execute fuzzed data
Monitor for exceptions
Determine exploitability
SSP, Sorena Secure Processing
FileFuzz

21. 21 SSP, Sorena Secure Processing
FileFuzz
FileFuzz is a graphical, Windows based file
format fuzzing tool. FileFuzz was designed to
automate the creation of abnormal file
formats and the execution of applications
handling these files. FileFuzz also has built in
debugging capabilities to detect exceptions
resulting from the fuzzed file formats.

22. SSP, Sorena Secure Processing
call your guys…

23. Type of Fuzzers
• File Fuzzers As the name implies, fuzzers that target file formats only. They
do not have the ability to speak any network protocol.
• Network Fuzzers And these are fuzzers that target only network protocols.
There are allot of these as the discovery of network based vulnerabilities
has always attracted allot of attention.
• General Fuzzers Following with our captain obvious theme, these fuzzers
that can target a wide variety of targets, typically both file and network,
and also others via custom I/O interfaces. For example: COM, shared
libraries, RPC, etc.
• Custom or One-off Fuzzers These are custom written fuzzers that target a
specific format or network protocol. Typically these hand written, many
times by testers. Custom fuzzers vary widely on how good their data
mutation/generation is. For the purposes of this document we will not
examine any custom or one-off fuzzers.
• API Fuzzers, Hardware Fuzzers and dozens of Fuzzers, There is not
limitations for subject… (Chapter 5, Page 161-166)
SSP, Sorena Secure Processing

24. Type of Fuzzers…
There is no limitation of, Intuitively I have to
say…
Where there is a Input, There’s Fuzz…
There is an undeniable fact,
Before start your cool fuzzing, please
formally let me know about your target.
SSP, Sorena Secure Processing

25. Example
• Standard HTTP GET request
– GET /index.html HTTP/1.1
• Anomalous requests
– AAAAAA...AAAA /index.html HTTP/1.1
– GET ///////index.html HTTP/1.1
– GET %n%n%n%n%n%n.html HTTP/1.1
– GET /AAAAAAAAAAAAA.html HTTP/1.1
– GET /index.html HTTTTTTTTTTTTTP/1.1
– GET /index.html HTTP/1.1.1.1.1.1.1.1
– etc...
SSP, Sorena Secure Processing

26. Example of
Vulnerable Source Code
#include <stdio.h>
int main( int argc, char *argv[] )
{
char buffer[1024];
strcpy(buffer,argv[1]);
printf("The string is a %s nn",buffer);
return 0;
}
SSP, Sorena Secure Processing

27. Example of
Simple Fuzzing scheme
import subprocess,time;
for i in range(1,10000):
print i;
subprocess.call(["./ example ","A"*i]);
time.sleep(1); # figure out debugger, crash log, etc.
Go head and run the application via uninvited
arguments such as and not limited to,
./example `python -c “print ‘A’*10000”`
SSP, Sorena Secure Processing

28. SSP, Sorena Secure Processing
The situation under controls...

29. Definition of fuzzing
“Fuzzing is a technique for intelligently and
automatically generating and passing into a
target system valid and invalid message
sequences to see if the system breaks, and
if it does, what it is that makes it break”
CODENOMICON
SSP, Sorena Secure Processing

30. The Solution That Found Heartbleed
 fuzzing(Defensics) was the primary
solution being used when the
Heartbleed flaw was identified.
A security research was running
a routine test of the Fuzzing
(Defensics) feature, SafeGuard, identifying the flaw
that had gone unidentified for over two years and
impacted over 500,000 websites.
SSP, Sorena Secure Processing
CODENOMICON

31. Fuzzing Approach
Mutation Based - “Dumb Fuzzing”
 Generation Based - “Smart Fuzzing”
 Evolutionary
SSP, Sorena Secure Processing

32. Mutation Based - “Dumb Fuzzing”
SSP, Sorena Secure Processing

33. Mutation Based - “Dumb Fuzzing”
• Little or no knowledge of the structure of the inputs is
assumed
• Anomalies are added to existing valid inputs
• Anomalies may be completely random or follow some
heuristics
• Requires little to no set up time
• Dependent on the inputs being modified
• May fail for protocols with checksums, those which depend
on challenge response, etc.
Examples:
• Taof, GPF, ProxyFuzz, etc.
SSP, Sorena Secure Processing

34. SSP, Sorena Secure Processing
Generation Based - “Smart Fuzzing”

35. Generation Based - “Smart Fuzzing”
• Test cases are generated from some description
of the format: RFC, documentation, etc.
• Anomalies are added to each possible spot in
the inputs
• Knowledge of protocol should give better results
than random fuzzing
• Can take significant time to set up
• Examples
– SPIKE, Sulley, Mu-4000, Codenomicon, Bestorm
SSP, Sorena Secure Processing

36. Evolutionary
SSP, Sorena Secure Processing

37. Evolutionary
• Attempts to generate inputs based on the
response of the program
• Autodafe
– Prioritizes test cases based on which inputs have
reached dangerous API functions
• EFS
– Generates test cases based on code coverage
metrics (more later)
• This technique is still in the alpha stage
SSP, Sorena Secure Processing

38. Issues & Problems
Mutation based fuzzers can generate an infinite
number of test cases... When has the fuzzer run long
enough?
Generation based fuzzers generate a finite number of
test cases. What happens when they’re all run and
no bugs are found?
How do you monitor the target application such that
you know when something “bad” has happened?
SSP, Sorena Secure Processing

39. Issues with Fuzzing
What happens when you find too many bugs? Or
every anomalous test case triggers the same (boring)
bug?
How do you figure out which test case caused the
fault?
Given a crash, how do you find the actual
vulnerability
After fuzzing, how do you know what changes to
make to improve your fuzzer?
When do you give up on fuzzing an application?
SSP, Sorena Secure Processing

40. Products & Frameworks
SSP, Sorena Secure Processing

41. Products & Frameworks
SSP, Sorena Secure Processing
Dozens of Open-Source Fuzzing Tools & Frameworks
has been collected in FoxFuzzing, there is list of
products with bit information of, are available by
https://github.com/khaleghsalehi/FoxFuzzing/list.pdf
Not(A2

42. ?
SSP, Sorena Secure Processing
Thank you &

43. References
1. SWE 681 / ISA 681,Secure Software Design & Programming, Lecture 9, Analysis
Approaches & Tools, Dr. David A. Wheeler, 2014-08-17
2. Real World Fuzzing, Charlie Miller, Independent Security Evaluators, ctober 19, 2007,
cmiller@securityevaluators.com
3. Robustness Testing, Discover unknown vulnerabilities with
Testing & QA, Ari Takanen, Codenomicon Ltd.
4. Michael Eddington, Leviathan Security Group, Inc. 2009
5. A Study of Commercially Available Fuzzers: Identification of Undisclosed Vulnerabilities
with the Aid of Commercial Fuzzing Tools. Prof. Dr. Hartmut Pohl and Daniel Baier, B.Sc.
Department of Computer Sciences, Bonn-Rhein-Sieg University of Applied Sciences
6. “Fuzzing for Software Security Testing and Quality Assurance”, Ari Takanen, Jared DeMott,
Charlie Miller Fuzzing for Software Security Testing and Quality Assurance (Artech House
Information Security and Privacy), 2008
7. Fuzzing: Brute Force Vulnerability Discovery Paperback – July 9, 2007 by Michael
Sutton, Adam Greene, Pedram Amini
8. Michael Sutton, Director, iDefense Labs, msutton@idefense.com, Fuzzing
Brute Force Vulnerability Discovery
9. [Slide No. 11.] A Study of Commercially Available Fuzzers: Identification of Undisclosed
Vulnerabilities with the Aid of Commercial Fuzzing Tools. By: Prof. Dr. Hartmut Pohl and
Daniel Baier, B.Sc. Department of Computer Sciences, Bonn-Rhein-Sieg University of
Applied Sciences.
SSP, Sorena Secure Processing

44. Awesome Books
SSP, Sorena Secure Processing
Fuzzing: Brute Force Vulnerability
Discovery Paperback – July 9, 2007
by Michael Sutton (Author), Adam
Greene (Author), Pedram Amini (Author)

45. Awesome Books
SSP, Sorena Secure Processing
Fuzzing for Software Security Testing and
Quality Assurance (Artech House Information
Security and Privacy) Hardcover – June 30,
2008
by Ari Takanen (Author), Jared
DeMott (Author), Charlie Miller (Author)

46. Awesome Books
SSP, Sorena Secure Processing
Open Source Fuzzing Tools Paperback –
December 28, 2007
by Noam Rathaus (Author), Gadi
Evron (Author)

47. Awesome Books
SSP, Sorena Secure Processing
Violent Python: A Cookbook for Hackers,
Forensic Analysts, Penetration Testers and
Security Engineers Paperback – August 11,
2012
& many so many
books…