By Skyler Onken

 Who am I?  What is Fuzzing?  Usual Targets  Techniques  Results  Limitations  Why Fuzz?  “Fuzzing the Web”?  Desired Solution  Solution  Enumeration Engine  Fuzzing Engine  Client  Demo  Remaining Issues  Future Improvements  Q/A

 Skyler Onken  BYU-Idaho Student (CIT)  Contingent Staff w/ LDS Church (QA)  Penetration Tester w/ SecureGossip Initiative  Security BYU-Idaho Linux User Group  Security+, CEH, ECSA 

 OWASP Definition:  “Fuzz testing or Fuzzing is a Black Box software testing technique, which basically consists in finding implementation bugs using malformed/semi-malformed data injection in an automated fashion.”

 Wikipedia  “Fuzz testing or fuzzing is a software testing technique that provides invalid, unexpected, or random data to the inputs of a program. If the program fails (for example, by crashing or failing built-in code assertions), the defects can be noted.”

 Synonyms  Robustness Testing  Syntax Testing  Negative Testing  White-Noise Testing

 File Formats  Network Protocols  Trust Boundary Crossing Software  Desktop Applications  Client Software  Web Applications  Web Services

 Specification-based  Random data  PRNG  Bit flipping

 Crashes  Memory Leaks  Assertion Failures  Buffer (Stack and Heap based) Overflows  Parsing Errors

 Find simple bugs  Black-Box  Strong dependency on seed

 Another point of view of testing  If its automated, why not?  Recent Fuzzing Successses:  Apple Wireless flaw DoS (MOKB )  Month of Browser Bugs: ▪ IE: 25 ▪ Safari: 2 ▪ Firefox: 2 ▪ Opera: 1 ▪ Konquerer: 1

 Enumeration  Massively deep and expansive  Ajax Problem  Most elements can be bound to dynamic action  Results  Detecting errors is difficult beyond checking return code  Possibly use baselines?

 Rune Hammersland pioneered semi-automation  Join together enumeration and fuzzing  The AJAX problem  Frameworks exist, but lack functionality  Peach  Sulley  RFuzz  Some tools exist, but not automated  Spike  WSFuzz  JBroFuzz  Wfuzz

 Easily and Fully Automated  Web Applications and Services  Reproducible Errors  Easy Reporting  “Fire and Forget”  AJAX

Client/Applet Enumeration engine Fuzzer Server

 Detects target type (app, soap, rest)  Will generate variations of enumerated test cases:  Crawljax (applications) ▪ Implements Selenium Web Driver ▪ Programmatically define HTML tags to exercise ▪ var2=normalValue  SoapUI API (services) ▪ Enumerates the WSDL/WADL for operations/resources

Web Application Fuzzer Crawler SOAP Test Cases

 Modular  Enables intelligence  Utilizes RC4  Reproducible  Handles requests and results  Results: != 200  Output to file; Database pending.

Fuzzing Engine Controller Module 3 Module 2 Module 1 Bad Chars Web Server

 Java Applet

 JVM Memory  Seed  Captchas  Automated Analysis

 Smarter Fuzzing  Automated Analysis  REST  Dictionary Support  DB 