9780321446114

Fuzzing Brute Force Vulnerability Discovery

by ; ;
  • ISBN13:

    9780321446114

  • ISBN10:

    0321446119

  • Edition: 1st
  • Format: Paperback
  • Copyright: 2007-06-29
  • Publisher: Addison-Wesley Professional
  • Purchase Benefits
  • Free Shipping On Orders Over $35!
    Your order must be $35 or more to qualify for free economy shipping. Bulk sales, PO's, Marketplace items, eBooks and apparel do not qualify for this offer.
  • Get Rewarded for Ordering Your Textbooks! Enroll Now
  • eCampus.com Device Compatibility Matrix

    Click the device icon to install or view instructions

    Apple iOS | iPad, iPhone, iPod
    Android Devices | Android Tables & Phones OS 2.2 or higher | *Kindle Fire
    Windows 10 / 8 / 7 / Vista / XP
    Mac OS X | **iMac / Macbook
    Enjoy offline reading with these devices
    Apple Devices
    Android Devices
    Windows Devices
    Mac Devices
    iPad, iPhone, iPod
    Our reader is compatible
     
     
     
    Android 2.2 +
     
    Our reader is compatible
     
     
    Kindle Fire
     
    Our reader is compatible
     
     
    Windows
    10 / 8 / 7 / Vista / XP
     
     
    Our reader is compatible
     
    Mac
     
     
     
    Our reader is compatible
List Price: $59.99 Save up to $23.52
  • Buy New
    $50.99
    Add to Cart Free Shipping

    CURRENTLY AVAILABLE, USUALLY SHIPS IN 24-48 HOURS

Supplemental Materials

What is included with this book?

  • The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.
  • The eBook copy of this book is not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

Summary

The only book to deeply cover fuzzing - the brute force way of finding errors in software.

Author Biography

M ICHAEL S UTTON

Michael Sutton is the Security Evangelist for SPI Dynamics. As Security Evangelist, Michael is responsible for identifying, researching, and presenting on emerging issues in the web application security industry. He is a frequent speaker at major information security conferences, has authored numerous articles, and is regularly quoted in the media on various information security topics.Michael is also a member of the Web Application Security Consortium (WASC), where he is project lead for the Web Application Security Statistics project.

Prior to joining SPI Dynamics,Michael was a Director for iDefense/VeriSign, where he headed iDefense Labs, a team of world class researchers tasked with discovering and researching security vulnerabilities.Michael also established the Information Systems Assurance and Advisory Services (ISAAS) practice for Ernst & Young in Bermuda. He holds degrees from the University of Alberta and The George Washington University. Michael is a proud Canadian who understands that hockey is a religion and not a sport. Outside of the office, he is a Sergeant with the Fairfax Volunteer Fire Department.

 

A DAM G REENE

Adam Greene is an engineer for a large financial news company based in New York City. Previously, he served as an engineer for iDefense, an intelligence company located in Reston, VA. His interests in computer security lie mainly in reliable exploitation methods, fuzzing, and UNIX-based system auditing and exploit development.

 

P EDRAM A MINI

Pedram Amini currently leads the security research and product security assessment team at TippingPoint. Previously, he was the assistant director and one of the founding members of iDefense Labs. Despite the fancy titles, he spends much of his time in the shoes of a reverse engineer–developing automation tools, plug-ins, and scripts. His most recent projects (a.k.a. “babies”) include the PaiMei reverse engineering framework and the Sulley fuzzing framework.

In conjunction with his passion, Pedram launched OpenRCE.org, a community website dedicated to the art and science of reverse engineering. He has presented at RECon, BlackHat, DefCon, ShmooCon, and ToorCon and taught numerous sold out reverse engineering courses. Pedram holds a computer science degree from Tulane University.

 

Table of Contents

Vulnerability discovery methodologiesp. 3
What is fuzzing?p. 21
Fuzzing methods and fuzzer typesp. 33
Data representation and analysisp. 45
Requirements for effective fuzzingp. 61
Automation and data generationp. 73
Environment variable and argument fuzzingp. 89
Environment variable and argument fuzzing : automationp. 103
Web application and server fuzzingp. 113
Web application and server fuzzing : automationp. 137
File format fuzzingp. 169
File format fuzzing : automation on UNIXp. 181
File format fuzzing : automation on windowsp. 197
Network protocol fuzzingp. 223
Network protocol fuzzing : automation on UNIXp. 235
Network protocol fuzzing : automation on windowsp. 249
Web Browser fuzzingp. 267
Web Browser fuzzing : automationp. 283
In-memory fuzzingp. 301
In-memory fuzzing : automationp. 315
Fuzzing frameworksp. 351
Automated protocol dissectionp. 419
Fuzzer trackingp. 437
Intelligent fault detectionp. 471
Lessons learnedp. 497
Looking forwardp. 507
Table of Contents provided by Blackwell. All Rights Reserved.

Excerpts

= 0) {slash = '\\';} else {slash = '/';}openLoc = figLoc.substring(0, figLoc.lastIndexOf(slash) + 1);while (pPage.substring(0,3) == '../') {openLoc = openLoc.substring(0, openLoc.lastIndexOf(slash, openLoc.length - 2)+ 1);pPage = pPage.substring(3, pPage.length + 1);}popUpWin =window.open('','popWin','resizable=1,scrollbars=1,location=0,toolbar=0,width=525,height=394');figDoc = popUpWin.document;zhtm= ' ' + pPage + ' ';zhtm += ' ';zhtm += ' ';zhtm += ' ';zhtm += '' + pPage.substring(pPage.lastIndexOf('/') + 1, pPage.length) + '';zhtm += ' ';figDoc.write(zhtm);figDoc.close();}// modified 3.1.99 RWE v4.1 --> Preface Preface"I know the human being and fish can coexist peacefully." - George W. Bush, Saginaw, Mich., Sept. 29, 2000 IntroductionThe concept of fuzzing has been around for almost two decades but has only recently captured widespread attention. In 2006, we saw a plague of new vulnerabilities emerge that affected popular client-side applications including Microsoft Internet Explorer, Microsoft Word and Microsoft Excel; a large portion of these vulnerabilities were discovered through fuzzing. As a result of fuzzing being used so successfully on these mainstream products, it has received a resurgence of attention from the security community. The sheer fact that this is the first published book dedicated to the subject matter is an additional indicator that there is an increasing interest in fuzzing.Having been involved in the vulnerability research community for years, we have used a variety of fuzzing technologies in our day to day work, ranging from hobby projects to high end commercial products. Each of the authors has been involved in the development of both privately held and publicly released fuzzers. We leveraged our combined experience and ongoing research projects to compose this bleeding edge book, which we hope you will find useful. Intended AudienceWe strongly believe that the quantity and severity of vulnerabilities will continue to grow so long as security is deemed to be the sole responsibility of a security team. As such, we have taken strong efforts to write for a larger audience than just security researchers, including both readers who are new to fuzzing and those who have already had significant experience.It is unrealistic to believe that secure applications can emerge from the development process if development organizations simply hand completed applications to a security team for a quick audit prior to production launch. Gone are the days when a developer or a member of the QA Team can say, "security's not my problem - we have a security team that worries about that".

Rewards Program

Write a Review