Fuzzing Brute Force Vulnerability Discovery

by Sutton, Michael; Greene, Adam; Amini, Pedram

• ISBN13: 9780321446114
• ISBN10: 0321446119
• Edition: 1st
• Format: Paperback
• Copyright: 2007-06-29
• Publisher: Addison-Wesley Professional

Summary

The only book to deeply cover fuzzing - the brute force way of finding errors in software.

Author Biography

M ICHAEL S UTTON

Michael Sutton is the Security Evangelist for SPI Dynamics. As Security Evangelist, Michael is responsible for identifying, researching, and presenting on emerging issues in the web application security industry. He is a frequent speaker at major information security conferences, has authored numerous articles, and is regularly quoted in the media on various information security topics.Michael is also a member of the Web Application Security Consortium (WASC), where he is project lead for the Web Application Security Statistics project.

Prior to joining SPI Dynamics,Michael was a Director for iDefense/VeriSign, where he headed iDefense Labs, a team of world class researchers tasked with discovering and researching security vulnerabilities.Michael also established the Information Systems Assurance and Advisory Services (ISAAS) practice for Ernst & Young in Bermuda. He holds degrees from the University of Alberta and The George Washington University. Michael is a proud Canadian who understands that hockey is a religion and not a sport. Outside of the office, he is a Sergeant with the Fairfax Volunteer Fire Department.

 

A DAM G REENE

Adam Greene is an engineer for a large financial news company based in New York City. Previously, he served as an engineer for iDefense, an intelligence company located in Reston, VA. His interests in computer security lie mainly in reliable exploitation methods, fuzzing, and UNIX-based system auditing and exploit development.

 

P EDRAM A MINI

Pedram Amini currently leads the security research and product security assessment team at TippingPoint. Previously, he was the assistant director and one of the founding members of iDefense Labs. Despite the fancy titles, he spends much of his time in the shoes of a reverse engineer–developing automation tools, plug-ins, and scripts. His most recent projects (a.k.a. “babies”) include the PaiMei reverse engineering framework and the Sulley fuzzing framework.

In conjunction with his passion, Pedram launched OpenRCE.org, a community website dedicated to the art and science of reverse engineering. He has presented at RECon, BlackHat, DefCon, ShmooCon, and ToorCon and taught numerous sold out reverse engineering courses. Pedram holds a computer science degree from Tulane University.

 

Table of Contents

Vulnerability discovery methodologies	p. 3
What is fuzzing?	p. 21
Fuzzing methods and fuzzer types	p. 33
Data representation and analysis	p. 45
Requirements for effective fuzzing	p. 61
Automation and data generation	p. 73
Environment variable and argument fuzzing	p. 89
Environment variable and argument fuzzing : automation	p. 103
Web application and server fuzzing	p. 113
Web application and server fuzzing : automation	p. 137
File format fuzzing	p. 169
File format fuzzing : automation on UNIX	p. 181
File format fuzzing : automation on windows	p. 197
Network protocol fuzzing	p. 223
Network protocol fuzzing : automation on UNIX	p. 235
Network protocol fuzzing : automation on windows	p. 249
Web Browser fuzzing	p. 267
Web Browser fuzzing : automation	p. 283
In-memory fuzzing	p. 301
In-memory fuzzing : automation	p. 315
Fuzzing frameworks	p. 351
Automated protocol dissection	p. 419
Fuzzer tracking	p. 437
Intelligent fault detection	p. 471
Lessons learned	p. 497
Looking forward	p. 507
Table of Contents provided by Blackwell. All Rights Reserved.

Excerpts

= 0) {slash = '\\';} else {slash = '/';}openLoc = figLoc.substring(0, figLoc.lastIndexOf(slash) + 1);while (pPage.substring(0,3) == '../') {openLoc = openLoc.substring(0, openLoc.lastIndexOf(slash, openLoc.length - 2)+ 1);pPage = pPage.substring(3, pPage.length + 1);}popUpWin =window.open('','popWin','resizable=1,scrollbars=1,location=0,toolbar=0,width=525,height=394');figDoc = popUpWin.document;zhtm= ' ' + pPage + ' ';zhtm += ' ';zhtm += ' ';zhtm += ' ';zhtm += '' + pPage.substring(pPage.lastIndexOf('/') + 1, pPage.length) + '';zhtm += ' ';figDoc.write(zhtm);figDoc.close();}// modified 3.1.99 RWE v4.1 --> Preface Preface"I know the human being and fish can coexist peacefully." - George W. Bush, Saginaw, Mich., Sept. 29, 2000 IntroductionThe concept of fuzzing has been around for almost two decades but has only recently captured widespread attention. In 2006, we saw a plague of new vulnerabilities emerge that affected popular client-side applications including Microsoft Internet Explorer, Microsoft Word and Microsoft Excel; a large portion of these vulnerabilities were discovered through fuzzing. As a result of fuzzing being used so successfully on these mainstream products, it has received a resurgence of attention from the security community. The sheer fact that this is the first published book dedicated to the subject matter is an additional indicator that there is an increasing interest in fuzzing.Having been involved in the vulnerability research community for years, we have used a variety of fuzzing technologies in our day to day work, ranging from hobby projects to high end commercial products. Each of the authors has been involved in the development of both privately held and publicly released fuzzers. We leveraged our combined experience and ongoing research projects to compose this bleeding edge book, which we hope you will find useful. Intended AudienceWe strongly believe that the quantity and severity of vulnerabilities will continue to grow so long as security is deemed to be the sole responsibility of a security team. As such, we have taken strong efforts to write for a larger audience than just security researchers, including both readers who are new to fuzzing and those who have already had significant experience.It is unrealistic to believe that secure applications can emerge from the development process if development organizations simply hand completed applications to a security team for a quick audit prior to production launch. Gone are the days when a developer or a member of the QA Team can say, "security's not my problem - we have a security team that worries about that".