FUZZING TECHNIQUES

By SUSAN MARTINEZ

CONTENTS CHAPTER 1 INTRODUCTION TO VULNERABILITY RESEARCH STATEMENT OF SCOPE OFF-BY-ONE ERRORS PROGRAMMING LANGUAGE USE ERRORS INTEGER OVER? OWS BUGS AND VULNERABILITIES THE VAUNTED BUFFER OVER? OW FINDING BUGS AND VULNERABILITIES SOURCE CODE REVIEW BLACK BOX TESTING GLASS BOX TESTING CHAPTER 2 FUZZING—WHAT’S THAT? INTRODUCTION INTRODUCTION TO FUZZING MILESTONES IN FUZZING FUZZING TECHNOLOGY TRAF? C SNIF? NG PREPARED TEMPLATE SECOND-GENERATION FUZZING FILE FUZZING HOST-SIDE MONITORING VULNERABILITY SCANNERS AS FUZZERS USES OF FUZZING OPEN SOURCE FUZZERS COMMERCIAL-GRADE FUZZERS WHAT COMES NEXT THE SOFTWARE DEVELOPMENT LIFE CYCLE CHAPTER 3 BUILDING A FUZZING ENVIRONMENT KNOWING WHAT TO ASK… BASIC TOOLS AND SETUP DATA POINTS CRASH DUMPS FUZZER OUTPUT DEBUGGERS RECON TOOLS LINUX OSX SUMMARY CHAPTER 4 OPEN SOURCE FUZZING TOOLS FRAMEWORKS SPECIAL-PURPOSE TOOLS GENERAL-PURPOSE TOOLS CHAPTER 5 COMMERCIAL FUZZING SOLUTIONS CHAPTER 6 BUILD YOUR OWN FUZZER HOLD YOUR HORSES FUZZER BUILDING BLOCKS ONE OR MORE VALID DATA SETS UNDERSTANDING WHAT EACH BYTEIN THE DATA SET MEANS CHANGE THE VALUES OF THE DATA SETS WHILE MAINTAINING THE INTEGRITY OFTHE DATA BEING SENT RECREATE THE SAME MALFORMED DATASET TIME AND TIME AGAIN AN ARSENAL OF MALFORMED VALUES, OR THE ABILITYTO CREATE A VARIETY OF MALFORMED OUTPUTS MAINTAIN A FORM OF A STATE MACHINE SUMMARIZE DOWN TO BUSINESS SIMPLEST FUZZ TESTING FIND ISSUES CHAPTER 7 INTEGRATION OF FUZZING IN THE DEVELOPMENT CYCLE WHY IS FUZZING IMPORTANT TO INCLUDE IN A SOFTWARE DEVELOPMENT CYCLE? SECURITY TESTING WORKLOAD SETTING EXPECTATIONS FOR FUZZERS IN A SOFTWARE DEVELOPMENT LIFECYCLE FUZZING AS A PANACEA FUZZING TOOLS VERSUS … SETTING THE PLAN FOR IMPLEMENTING FUZZERS INTO A SOFTWARE DEVELOPMENT LIFECYCLE SETTING GOALS BUILDING AND EXECUTING ON THE PLAN UNDERSTANDING HOW TO INCREASE EFFECTIVENESS OF FUZZERS, AND AVOIDING ANY BIG GOTCHAS HIDDEN COSTS FINDING MORE VULNERABILITIES SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 8 STANDARDIZATION AND CERTI? CATION FUZZING AND THE CORPORATE ENVIRONMENT SOFTWARE SECURITY TESTING, THE CHALLENGES TESTING FOR SECURITY FUZZING AS A VIABLE OPTION BUSINESS PRESSURE SOFTWARE SECURITY CERTI? CATION MEETING STANDARDS AND COMPLIANCE TESTER CERTI? CATION INDUSTRY PRESSURE ANTIVIRUS PRODUCT TESTING AND CERTI? CATION CHAPTER 9 WHAT IS A FILE? ARE FILE FUZZERS SPECIAL? ANALYZING AND BUILDING FILES TEXTUAL FILES BINARY FILES RUNNING THE TEST MONITORING THE APPLICATION WITH THE TEST CASES CHAPTER 10 CODE COVERAGE AND FUZZING CODE COVERAGE OBTAINING CODE COVERAGE INSTRUMENTING THE BINARY MONITORING A CLOSED SOURCE APPLICATION IMPROVING FUZZING WITH CODE COVERAGE MANUAL IMPROVEMENTS DYNAMICALLY GENERATING CODE COVERAGE IMPROVEMENTS