A State-Aware Protocol Fuzzer Based on Application-Layer Protocols
In the face of constant malicious attacks to network-connected software systems, software vulnerabilities need to be discovered early in the development phase. In this paper, we present Asp Fuzz, a state-aware protocol fuzzer based on the specifications of application-layer protocols. Asp Fuzz automatically generates anomalous messages that exploit possible vulnerabilities. The key observation behind Asp Fuzz is that most attack messages violate the strict specifications of application-layer protocols. For example, they do not conform to the rigid format or syntax required of each message. In addition, some attack messages ignore the protocol states and have incorrect orders of messages. Asp Fuzz automatically generates a large number of anomalous messages that deliberately violate the specifications of application-layer protocols. To demonstrate the effectiveness of Asp Fuzz, we conducted experiments with POP3 and HTTP servers. With Asp Fuzz, we can discover 20 reported and 1 previously unknown vulnerabilities for POP3 servers and 25 reported vulnerabilities for HTTP servers. Two vulnerabilities among these can be discovered by the state-awareness of Asp Fuzz. It can also find a SIP state-related vulnerability.
fuzzing software vulnerability testing protocol specification