Sutton M., Green A., Amini P. Fuzzing: Brute Force Vulnerability Discovery

Addison-Wesley, 2007. — 513 p. — ISBN: 0-32-144611-9Fuzzing has evolved into one of today’s most effective approaches to test software security. To “fuzz,” you attach a program’s inputs to a source of random data, and then systematically identify the failures that arise. Hackers have
relied on fuzzing for years: Now, it’s your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:• Why fuzzing simplifies test design and catches flaws other methods miss
• The fuzzing process: from identifying inputs to assessing “exploitability”
• Understanding the requirements for effective fuzzing
• Comparing mutation-based and generation-based fuzzers
• Using and automating environment variable and argument fuzzing
• Mastering in-memory fuzzing techniques
• Constructing custom fuzzing frameworks and tools
• Implementing intelligent fault detectionAttackers are already using fuzzing. You should, too. Whether you’re a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.ForewordAbout the AuthorBACKGROUND
Vulnerability Discovery Methodologies
What Is Fuzzing?
Fuzzing Methods and Fuzzer Types
Data Representation and Analysis
Requirements for Effective FuzzingTARGETS AND AUTOMATION
Automation and Data Generation
Environment Variable and Argument Fuzzing
Environment Variable and Argument Fuzzing: Automation
Web Application and Server Fuzzing
Web Application and Server Fuzzing: Automation
File Format Fuzzing
File Format Fuzzing: Automation on Unix
File Format Fuzzing: Automation on Windows
Network Protocol Fuzzing
Network Protocol Fuzzing: Automation on Unix
Network Protocol Fuzzing: Automation on Windows
Web Browser Fuzzing
Web Browser Fuzzing: Automation
In-Memory Fuzzing
In-Memory Fuzzing: AutomationADVANCED FUZZING TECHNOLOGIES
Fuzzing Frameworks
Automated Protocol Dissection
Fuzzer Tracking
Intelligent Fault DetectionLOOKING FORWARD
Lessons Learned
Looking Forward