FAQ - Fuzzing 101
New to fuzzing? As fuzzing is seeing increasing adoption in the dev community, we want to answer your questions about this topic as good as we can. In the below FAQ, we want to get you acquainted with fuzzing so you can create your own fuzz tests soon. Let's start with the basics. Feel free to skip ahead if you are already familiar with this.
1. What is a fuzzer?
Fuzzing is a dynamic testing method used to identify bugs and vulnerabilities in software. It is mainly used for security and stability testing of the codebase. A fuzzer tests the software under test by feeding it with a series of inputs. In their most basic form, fuzzers generate these test inputs at random or based on a predefined set of values.
This bare-bones form of fuzzing is a black-box approach, that is often used by attackers, as it does not require access to the source code. Black-box fuzzers are easy to set up and inexpensive. However, they are not overly sophisticated, which has earned them the name dumb fuzzers in some circles. The more sophisticated counterpart to so-called dumb fuzzers are feedback-based fuzzers, also called smart fuzzers.
2. What is feedback-based fuzzing?
As the name implies, feedback-based fuzzers collect feedback about the code covered during the execution of inputs. Unlike testing tools that generate test inputs randomly, this information allows feedback-based fuzzers to constantly refine and improve test inputs and to monitor which parts of the program they reach. By leveraging code coverage, feedback-based fuzzers can traverse larger parts of the source code and trigger deeply hidden bugs and vulnerabilities. Since code coverage is one of the most important metrics in software security testing, feedback-based fuzzing tools can provide useful reports that aid in the interpretation of test findings.
3. Why is fuzzing (especially) useful for security testing?
There are some features that make software fuzzing enormously useful for security testing. Here is why:
- Fuzzing can be almost completely automated
- Fuzzing tools do not only find vulnerabilities; they also provide the inputs that trigger them
- Fuzzing detects bugs without false positives
4. What is a fuzz target?
Fuzz targets are small programs that test predefined API functions, similar to unit tests. However, the inputs are not provided by the developer, but produced by fuzz generators. The generators are responsible for creating random mutations of inputs that are sent to the software under test (SUT). The output of a fuzz generator (i.e., random inputs) is then sent to the SUT. The delivery mechanism processes inputs from the fuzz generator and feeds them to the SUT for execution.
Finally, the monitoring system keeps track of how inputs are executed within the SUT and detects triggered bugs. This plays a critical part in the software fuzzing process, as it also influences what types of vulnerabilities can be discovered during fuzzing.
Example of a fuzz target, for Java Applications
Click here to learn how to set up fuzz targets yourself.
public class ExampleValueProfileFuzzer {
// consume data from fuzzer and give it to function under test
public static void fuzzerTestOneInput(FuzzedDataProvider data) {
String str = data.consumeString(100); // get a string with max_len 100
long input1 = data.consumeLong();
long input2 = data.consumeLong();
// call function under test with fuzz data
ApplicationUnderTest.consume(str, input1, input2);
}
5. How do I set up continuous fuzzing?
Continuous fuzzing enables dev team to automatically test their code within their favorite dev tools. The effort required to set up a continuous fuzzing cycle with open-source fuzzers is often underestimated. It requires a huge amount of manual configuration and maintenance, while usually not delivering the same results as an enterprise solution. With an enterprise solution, the set-up can be done much faster by simply following an installation manual. Find out everything about our enterprise solution by requesting a free demo.
6. How can I debug my code after a fuzz test?
Modern fuzzing tools enable debugging with a few simple clicks. Since the code is executed during fuzz testing, the crashing input can easily be identified. As presented below, modern fuzzing platforms can immediately take users to the section of the code and set break-points in the stack trace, which enables effortless debugging.
7. We use static analysis. Why do we need fuzzing?
While static analysis (SAST) has undeniable advantages, such as immediate feedback loops, the moment developers write code in the IDE, it also has a few disadvantages:
-
The fatigue among developers due to false positives
-
Some bugs and vulnerabilities cannot be identified through static analysis. Some examples include Runtime or Dynamic Behavior Issues, Input-Dependent Flaws, Integration and Environment-Related Issues, Security Misconfigurations, and Behavioral and Logic Flaws.
The best security practice involves leveraging both static and dynamic testing, such as fuzz testing. Integrating fuzz testing and SAST helps cover a broader range of potential issues early in development, reducing false positives and negatives and ensuring compliance with requirements.
An automotive company using static analysis detects 32% of bugs solely through fuzz testing. Learn more here.
.webp?width=1136&height=621&name=Instrumented%20Fuzzing%20(transparent).webp)
Static Analysis and Code Fuzzing in the V-model