Automated Fuzz Testing: The Power of Code Intelligence App
Tags: testing, productivity, opensource, security
Published: 2023-03-18 08:07:00

Software applications are becoming increasingly complex, and with complexity comes an increased risk of security vulnerabilities and defects. While traditional testing methods can help identify many of these issues, they are often insufficient when it comes to discovering vulnerabilities in software that processes unstructured or user-generated input. This is where [Fuzz testing](https://www.code-intelligence.com/what-is-fuzz-testing), also known as _fuzzing_, comes in. 

👉 In this article, we will explore **what fuzz testing is, how it works, and how to achieve automated Fuzz testing** for improving software security.

## Learning objectives 📖

You will learn and get an answer to the following questions throughout the article:

- What's Fuzz Testing?
- How Does Fuzz Testing Work?
- A modern way to apply security testing with Code Intelligence.
- An automated approach to Fuzz testing.
- [CI App](https://docs.code-intelligence.com/ci-app) Demo for Fuzz testing.

## What is Fuzz Testing?

[Fuzz testing](https://www.code-intelligence.com/what-is-fuzz-testing) is a software testing technique that involves providing unexpected, invalid, or random data as input to a program. The goal of fuzz testing is to discover vulnerabilities and defects in software applications that may not be easily discovered through other testing methods.

![Fuzz testing different inputs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/it4k8o0vzwvmx6xluu85.png)

The basic idea behind fuzz testing is to simulate an attacker trying to exploit vulnerabilities in the software. By providing unexpected or invalid inputs, the tester is trying to discover how the program will behave under unusual circumstances. This can help identify security vulnerabilities, memory leaks, crashes, and other defects that could be exploited by attackers.

## How Does Fuzz Testing Work?

Fuzz testing typically involves _four main steps_:

1. **Input Generation**: The tester uses a fuzzing tool such as [CI Fuzz](https://github.com/CodeIntelligenceTesting/cifuzz) or [Jazzer](https://github.com/CodeIntelligenceTesting/jazzer) to generate random or unexpected inputs to the software application.
2. **Input Injection**: The generated inputs are then injected into the application, either through the user interface, network input, or other means.
3. **Monitoring**: The application's behavior is monitored for any unusual behavior or errors, such as crashes or memory leaks.
4. **Analysis**: Once the testing is complete, the results are analyzed to identify any vulnerabilities or defects in the software.

![Fuzz testing steps](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ce0nvqdc81vgz3zy2ojz.png)

There are several types of fuzz testing techniques, including black-box, white-box, and grey-box fuzz testing. **Black-box** fuzz testing involves testing the program without any knowledge of its internal workings, while **white-box** fuzz testing involves testing the program with full access to its source code and internal data structures. **Grey-box** fuzz testing is a combination of both approaches, where the tester has some knowledge of the internal workings of the program but not full access.

## What is Code Intelligence?

[Code Intelligence](https://www.code-intelligence.com/) offers automated testing solutions such as [CI Fuzz](https://github.com/CodeIntelligenceTesting/cifuzz) is an open-source command line tool designed to create fuzz tests and automate the fuzz testing process. It can be integrated into Continuous Integration (CI) pipelines, making it easier to run and manage the testing process. For example, it can help developers ship secure software by providing the necessary integrations to test their code at each pull request.  CI Fuzz supports a wide range of programming languages, including C, C++, JavaScript, Java, Kotlin, and other JVM-based languages.

You can check other projects developed by Code Intelligence on [GitHub repository](https://github.com/codeIntelligenceTesting).

## An automated approach to Fuzz testing

You can also leverage [CI App](https://docs.code-intelligence.com/ci-app) together with the CLI tool to run Fuzz tests.  It provides detailed reports on the results of Fuzz tests. This includes information on the number of test cases run, the number of bugs found, coverage metrics,  and the severity of each bug. This helps you to prioritize and address the most critical issues first. 

Follow the [CI App Quick Start](https://docs.code-intelligence.com/ci-app-quick-start) guide to install and configure it on your local system. For this demo purpose, we are going to use an already deployed and [built-in CI App solution](https://app.code-intelligence.com/login) on the Code Intelligence website.

Now you are going to learn how to enable application security testing features with easy steps.

## CI App Demo for Fuzz testing

### Step 1:

Open your browser and navigate to the [CI App playground](https://app.code-intelligence.com/login) on Code the Code Intelligence website and login into the system using your **GitHub account**. Once you logged in, you will see the CI App dashboard with the empty project because we haven’t added our project there yet (You can also play with some featured projects out there).

![CI App Demo](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/odwvfni5698v0gzj3vot.png)

### Step 2:

Now you can try to find your first bug in your project. We are going to use a [simple ready java project](https://github.com/Boburmirzo/java-demo) that has two already vulnerabilities - a [SQL injection](https://en.wikipedia.org/wiki/SQL_injection) and an [RCE](https://encyclopedia.kaspersky.com/glossary/remote-code-execution-rce/). 

### Step 3:

In the navigation bar, open the **Projects** dropdown and click **Add Project**. It will open a new pop-up menu where you specify `Project Name` and provide a `GitHub URL` link to our sample Java project. 

![Add CI fuzz project](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ojmsg31fdf0xn44s2eri.png)

### Step 4:

In the sample Java project, we have existing fuzz tests (You can check the test under [this folder](https://github.com/Boburmirzo/java-demo/tree/main/.code-intelligence)) and it has [GitHub action](https://github.com/features/actions) is set up. Only thing you need us to set into a [GitHub Workflow file](https://github.com/Boburmirzo/java-demo/tree/main/.github/workflows) is an action secret called `CI_FUZZ_API_TOKEN` with your API token. You can generate it under your **Account** setting on the **Tokens** tab.

![Update the CI Fuzz token](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sfltzi5a7zpldj0srb4o.png)

> Follow [this instruction](https://docs.github.com/en/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository) to create encrypted secrets for a repository on GitHub.

### Step 5:

Up to now everything is set up, you may need to trigger your CI/CD, either manually or by submitting a new PR. Then you will be able to see the two vulnerabilities that CI Fuzz detected and step into the code directly to see the underlying cause👏. For example, to view additional details about coverage, just click **Code Coverage** on the left sidebar. This will show you the overall coverage and a breakdown of the coverage by file. 

![Test new project](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e09q5ytnvo48ap54sj05.png)

## What next☝️

Overall, fuzz testing is a powerful technique for improving software quality and security by identifying and fixing defects before they can be exploited by attackers or cause problems for users. Tools such as CI Fuzz is a powerful tools that can help you automate the fuzz testing process. By integrating CI Fuzz into your software development pipeline, you can save time, improve reliability, increase security, and reduce costs.

Next steps, you can observe [other features](https://docs.code-intelligence.com/ci-app-findings) of the CI App and start to develop your own tests using the programming languages you are most familiar with.

#### Related resources 📓 

- [What Is Fuzz Testing?](https://www.code-intelligence.com/what-is-fuzz-testing)

- [About CI App](https://docs.code-intelligence.com/ci-app)

- [About CI Fuzz](https://docs.code-intelligence.com/ci-fuzz)

#### Recommended content 💁

- [Best Practices for REST API Testing](https://www.code-intelligence.com/rest-api-testing)

- [Best Practices for JUnit Testing](https://www.code-intelligence.com/junit-testing)

#### Community

🙋 Join the [Code Intelligence Community](https://github.com/CodeIntelligenceTesting)

#### About the author 🙎

Visit my personal blog: [www.iambobur.com](https://www.iambobur.com/)