Fuzzing: Brute Force Vulnerability Discovery
Authors: Michael Sutton, Adam Greene, Pedram Amini
Venue:  (2007)

FUZZINGMaster One of Today's Most Powerful Techniques for Revealing Security Flaws!Fuzzing has evolved into one of today's most effective approaches to test software security. To “fuzz,” you attach a program's inputs to a source of random data, and then systematically identify the failures that arise. Hackers haverelied on fuzzing for years: Now, it's your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:· Why fuzzing simplifies test design and catches flaws other methods miss· The fuzzing process: from identifying inputs to assessing “exploitability”· Understanding the requirements for effective fuzzing· Comparing mutation-based and generation-based fuzzers· Using and automating environment variable and argument fuzzing· Mastering in-memory fuzzing techniques· Constructing custom fuzzing frameworks and tools· Implementing intelligent fault detectionAttackers are already using fuzzing. You should, too. Whether you're a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.Forewordï¾ ï¾ ï¾ ï¾ xix Prefaceï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ xxiAcknowledgmentsï¾ xxvAbout the Authorï¾ ï¾ xxvii PARTIï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ BACKGROUNDï¾ ï¾ ï¾ ï¾ 1Chapter 1ï¾ ï¾ ï¾ Vulnerability Discovery Methodologiesï¾ 3Chapter 2ï¾ ï¾ ï¾ What Is Fuzzing?ï¾ ï¾ 21Chapter 3ï¾ ï¾ ï¾ Fuzzing Methods and Fuzzer Typesï¾ ï¾ ï¾ ï¾ 33Chapter 4ï¾ ï¾ ï¾ Data Representation and Analysisï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 45Chapter 5ï¾ ï¾ ï¾ Requirements for Effective Fuzzingï¾ ï¾ ï¾ ï¾ ï¾ 61PART IIï¾ ï¾ ï¾ ï¾ ï¾ TARGETS AND AUTOMATIONï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 71Chapter 6ï¾ ï¾ ï¾ Automation and Data Generationï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 73Chapter 7ï¾ ï¾ ï¾ Environment Variable and Argument Fuzzing 89Chapter 8ï¾ ï¾ ï¾ Environment Variable and Argument Fuzzing: Automation 103Chapter 9ï¾ ï¾ ï¾ Web Application and Server Fuzzingï¾ ï¾ ï¾ ï¾ 113Chapter 10ï¾ Web Application and Server Fuzzing: Automationï¾ ï¾ ï¾ 137Chapter 11ï¾ File Format Fuzzingï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 169Chapter 12ï¾ File Format Fuzzing: Automation on UNIXï¾ ï¾ ï¾ ï¾ 181Chapter 13ï¾ File Format Fuzzing: Automation on Windowsï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 197Chapter 14ï¾ Network Protocol Fuzzingï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 223Chapter 15ï¾ Network Protocol Fuzzing: Automation on UNIXï¾ ï¾ ï¾ ï¾ 235Chapter 16ï¾ Network Protocol Fuzzing: Automation on Windowsï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 249Chapter 17ï¾ Web Browser Fuzzingï¾ ï¾ ï¾ ï¾ ï¾ 267Chapter 18ï¾ Web Browser Fuzzing: Automationï¾ ï¾ ï¾ ï¾ 283Chapter 19ï¾ In-Memory Fuzzingï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 301Chapter 20ï¾ In-Memory Fuzzing: Automationï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 315PART IIIï¾ ï¾ ï¾ ADVANCED FUZZING TECHNOLOGIESï¾ ï¾ ï¾ ï¾ ï¾ 349Chapter 21ï¾ Fuzzing Frameworksï¾ ï¾ ï¾ ï¾ ï¾ ï¾ 351Chapter 22ï¾ Automated Protocol Dissectionï¾ 419Chapter 23ï¾ Fuzzer Trackingï¾ ï¾ ï¾ ï¾ 437Chapter 24ï¾ Intelligent Fault Detection 471PART IVï¾ ï¾ ï¾ ï¾ LOOKING FORWARDï¾ ï¾ ï¾ 495Chapter 25ï¾ Lessons Learnedï¾ ï¾ ï¾ 497Chapter 26ï¾ Looking Forwardï¾ ï¾ ï¾ 507Index 519