- [Instructor] Fuzz testing, or fuzzing,
is a very important software security testing technique.
Fuzzing provides many different types of valid
and invalid input to software in an input
to make it enter an unpredictable state
or disclose confidential information.
It works by automatically generating input values
and feeding them to the software package.
Fuzzing can use different input services.
The developer running the test can supply
a long or short list of input values.
The developer running the test can write a script
that generates input values.
The fuzz testing software can generate input values randomly
or from a specification.
This is known as generation fuzzing.
Or the fuzz tester can analyze real input
and then modify those real values.
This is known as mutation fuzzing.
Let's take an example of fuzz testing.
We'll use the Zed application proxy,
or ZAP, available for free
from the Open Web Application Security Project, OWASP.
Here I am inside ZAP.
I'm going to go ahead and use the ZAP browser
to visit a common website, Wikipedia.
I'm going to hit the Attack button here, and as I do that,
ZAP is going to begin spidering the website.
You can see down here we're quickly scrolling through
lots and lots of different URLs.
ZAP's already discovered over a thousand of them.
This would keep going because Wikipedia's a huge site,
so I'm going to go ahead and stop this
because I have enough for our purposes.
If I go over to the left side here and expand the Sites
and then look at the Wikipedia site folder
that's been spidered,
I'm just going to drill down into one of these,
let's say the W folder.
So this is en.wikipedia.org/w/api.php.
There's a web page we can take a look at.
It looks like the PHP form to access an API.
So I've selected that page.
I can go over here and look at the Request
to see what exactly the web browser sent to this page
in order to generate some output.
And, up on the top line here,
I see the actual GET command that went to the api.php page.
Then in the query string I can see it had this one argument,
action=mobileview, so this is where I can start
playing with fuzz testing a little bit.
Let's say I want to know what would happen
if I typed other things in here instead of mobileview,
but I want to do that in an automated fashion
where I don't have to keep generating each request
and checking for the response.
I can go ahead and highlight mobileview right here,
then right-click on it and choose Fuzz.
This brings up the fuzz testing input,
and you can see mobileview is highlight in green.
And, over here in Fuzz Locations, it has that same green.
I'm going to go ahead now and tell the fuzzer
that I want to give it some input.
I'm going to click Payloads here,
and I'm going to add some different payloads.
These payloads are just the input
that are going to be provided
to the api.php page when the fuzz testing begins.
And, to keep things simple,
I'm going to choose the simplest type of fuzz testing.
I'm just going to give it a bunch of different strings.
Now, I remember this was an action.
One of the things was mobileview.
That was the valid input
that was generated automatically by the spider.
So I'm just going to try some strings here
that might do something else.
We have mobileview, so maybe we have fullview
or desktopview or browserview.
I'm also going to try,
test is always a good thing to do in your fuzz testing.
Maybe there's a test action
or admin, administrator, superuser.
I can also try just some random words,
whatever I wanted here: apple, orange, grape.
If I was doing fuzz testing on an application
that I had written, I'd probably have a very long list
of terms based on my knowledge of the application,
but I could also throw in just a standard list of things
that I try all the time.
So we're going to do a short fuzz test here.
We only have about 10 words that we're going to try,
but we could do this with hundreds or even thousands
of different string inputs.
There are other options.
I could have chosen to use a script,
all these different things I mentioned earlier,
file types, regular expressions.
We're going to keep things simple
and do string-based fuzz testing
where I've told it the strings.
I'm going to click the Add button here
to add those payloads, choose OK,
and then all I have to do is click Start Fuzzer.
And what will happen now is ZAP
is going to start trying all those different input options,
and you can see down here it's already completed.
If I scroll up, there's all of the different things
that I tried.
I tried fullview, desktopview, browserview.
All the keywords I specified as string inputs
are displayed as lines down here,
and each one of these lines corresponds to an HTTP request.
We had the original page, that's the top line,
and then the next lines indicate
each one of the fuzzed message types
where it tried one of my different inputs.
I only tried 10, so there were 11 messages sent,
getting the original page
and then the 10 fuzzed options that I gave it.
But if I had specified thousands of choices here,
there would have been thousands of messages sent.
It happens very quickly.
It really rapidly automates this type of testing.
If I choose one of these fuzzed inputs,
you can go up here and see the request and the response.
So let's look at the request first.
This looks very similar to what we started with earlier.
We have the GET command and then the page, api.php,
and then the action, and instead of mobileview,
this is the one where it said desktopview.
I can click over here, then, and see what output
the web server provided in response to that.
And you can see here there's a whole lot of HTML
that came as output, and I could look at this in my browser.
I could scroll through this and look for abnormal results.
That's a little bit outside the scope of this video,
but this is the idea of how fuzz testing works,
rapidly testing all sorts of different variations
to see how software responds.
Now, this was a very simple example of fuzzing,
and we only scratched the surface of ZAP,
which is a very valuable code-testing tool.
If we were performing a real fuzz test,
we'd spend some time understanding
how the application worked in more detail
and perhaps write some scripts
that generate very realistic input examples
that attempted to break the application security.
One word of caution as we wrap up.
Fuzz testing is a very valuable tool
for security professionals, but it should only be used
when you have permission to perform the test.
Other networks may be consider fuzz testing attempts
as attacks and trigger intrusion prevention systems
and other incident response mechanisms.