×

Uh-oh, it looks like your Internet Explorer is out of date.

For a better shopping experience, please upgrade now.

Fuzzing: Brute Force Vulnerability Discovery
  • Alternative view 1 of Fuzzing: Brute Force Vulnerability Discovery
  • Alternative view 2 of Fuzzing: Brute Force Vulnerability Discovery
     

Fuzzing: Brute Force Vulnerability Discovery

by Michael Sutton, H. D. Moore, Adam Greene, Pedram Amini
 

See All Formats & Editions

ISBN-10: 0321446119

ISBN-13: 9780321446114

Pub. Date: 07/06/2007

Publisher: Addison-Wesley

FUZZING

Master One of Today’s Most Powerful Techniques for Revealing Security Flaws!

Fuzzing has evolved into one of today’s most effective approaches to test software security. To “fuzz,” you attach a program’s inputs to a source of random data, and then systematically identify the failures that arise. Hackers have

relied on

Overview

FUZZING

Master One of Today’s Most Powerful Techniques for Revealing Security Flaws!

Fuzzing has evolved into one of today’s most effective approaches to test software security. To “fuzz,” you attach a program’s inputs to a source of random data, and then systematically identify the failures that arise. Hackers have

relied on fuzzing for years: Now, it’s your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.

Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:

• Why fuzzing simplifies test design and catches flaws other methods miss

• The fuzzing process: from identifying inputs to assessing “exploitability”

• Understanding the requirements for effective fuzzing

• Comparing mutation-based and generation-based fuzzers

• Using and automating environment variable and argument fuzzing

• Mastering in-memory fuzzing techniques

• Constructing custom fuzzing frameworks and tools

• Implementing intelligent fault detection

Attackers are already using fuzzing. You should, too. Whether you’re a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.

Foreword xix

Preface xxi

Acknowledgments xxv

About the Author xxvii

P ARTI B ACKGROUND 1

Chapter 1 Vulnerability Discovery Methodologies 3

Chapter 2 What Is Fuzzing? 21

Chapter 3 Fuzzing Methods and Fuzzer Types 33

Chapter 4 Data Representation and Analysis 45

Chapter 5 Requirements for Effective Fuzzing 61

P ART II T ARGETS AND A UTOMATION 71

Chapter 6 Automation and Data Generation 73

Chapter 7 Environment Variable and Argument Fuzzing 89

Chapter 8 Environment Variable and Argument Fuzzing: Automation 103

Chapter 9 Web Application and Server Fuzzing 113

Chapter 10 Web Application and Server Fuzzing: Automation 137

Chapter 11 File Format Fuzzing 169

Chapter 12 File Format Fuzzing: Automation on UNIX 181

Chapter 13 File Format Fuzzing: Automation on Windows 197

Chapter 14 Network Protocol Fuzzing 223

Chapter 15 Network Protocol Fuzzing: Automation on UNIX 235

Chapter 16 Network Protocol Fuzzing: Automation on Windows 249

Chapter 17 Web Browser Fuzzing 267

Chapter 18 Web Browser Fuzzing: Automation 283

Chapter 19 In-Memory Fuzzing 301

Chapter 20 In-Memory Fuzzing: Automation 315

P ART III A DVANCED F UZZING T ECHNOLOGIES 349

Chapter 21 Fuzzing Frameworks 351

Chapter 22 Automated Protocol Dissection 419

Chapter 23 Fuzzer Tracking 437

Chapter 24 Intelligent Fault Detection 471

P ART IV L OOKING F ORWARD 495

Chapter 25 Lessons Learned 497

Chapter 26 Looking Forward 507

Index 519

Product Details

ISBN-13:
9780321446114
Publisher:
Addison-Wesley
Publication date:
07/06/2007
Pages:
543
Product dimensions:
6.90(w) x 9.10(h) x 1.20(d)

Table of Contents

Foreword xix

Preface xxi

Acknowledgments xxv

About the Author xxvii

P ARTI B ACKGROUND 1

Chapter 1 Vulnerability Discovery Methodologies 3

Chapter 2 What Is Fuzzing? 21

Chapter 3 Fuzzing Methods and Fuzzer Types 33

Chapter 4 Data Representation and Analysis 45

Chapter 5 Requirements for Effective Fuzzing 61

P ART II T ARGETS AND A UTOMATION 71

Chapter 6 Automation and Data Generation 73

Chapter 7 Environment Variable and Argument Fuzzing 89

Chapter 8 Environment Variable and Argument Fuzzing: Automation 103

Chapter 9 Web Application and Server Fuzzing 113

Chapter 10 Web Application and Server Fuzzing: Automation 137

Chapter 11 File Format Fuzzing 169

Chapter 12 File Format Fuzzing: Automation on UNIX 181

Chapter 13 File Format Fuzzing: Automation on Windows 197

Chapter 14 Network Protocol Fuzzing 223

Chapter 15 Network Protocol Fuzzing: Automation on UNIX 235

Chapter 16 Network Protocol Fuzzing: Automation on Windows 249

Chapter 17 Web Browser Fuzzing 267

Chapter 18 Web Browser Fuzzing: Automation 283

Chapter 19 In-Memory Fuzzing 301

Chapter 20 In-Memory Fuzzing: Automation 315

P ART III A DVANCED F UZZING T ECHNOLOGIES 349

Chapter 21 Fuzzing Frameworks 351

Chapter 22 Automated Protocol Dissection 419

Chapter 23 Fuzzer Tracking 437

Chapter 24 Intelligent Fault Detection 471

P ART IV L OOKING F ORWARD 495

Chapter 25 Lessons Learned 497

Chapter 26 Looking Forward 507

Index 519

Customer Reviews

Average Review:

Post to your social network

     

Most Helpful Customer Reviews

See all customer reviews