- [Instructor] Fuzz testing, or fuzzing,
is a very important software security testing technique.
Fuzzing provides many different types of valid
and invalid input to software
in an attempt to make it enter an unpredictable state
or disclose confidential information.
It works by automatically generating input values
and feeding them to the software package.
Fuzzing can use different input sources.
The developer running the test
can supply a long or short list of input values.
The developer running the test can write a script
that generates input values.
The fuzz testing software can generate input values randomly
or from a specification.
This is known as generation fuzzing.
Or the fuzz tester can analyze real input
and then modify those real values.
This is known as mutation fuzzing.
Let's take a look at an example of fuzz testing.
We'll use the Zed Application Proxy, or ZAP,
available for free from
the Open Web Application Security Project, OWASP.
Here I am, inside ZAP.
I'm going to go ahead and use the ZAP Browser
to visit a common website, Wikipedia.
I'm going to hit the Attack button here,
and, as I do that,
ZAP is going to begin spidering the website.
You can see down here, we're quickly scrolling through lots
and lots of different URLs.
ZAP's already discovered over a thousand of them.
This would keep going 'cause Wikipedia's a huge site.
So I'm going to go ahead and stop this
because I have enough for our purposes.
If I go over to the left side here and expand the Sites
and then look at the Wikipedia site
folder that's been spidered, I'm just going to drill down
into one of these, let's say the W folder.
So this is en.wikipedia.org/w/api.php.
There's a webpage we can take a look at.
It looks like the PHP form to access an API.
So I've selected that page.
I can go over here and look at the request
to see what exactly the web browser sent to this page
in order to generate some output.
And up on the top line here, I see the actual GET command
that went to the api.php page.
Then, in the query string,
I can see it had this one argument, action=mobileview.
So this is where I can start playing
with fuzz testing a little bit.
Let's say I want to know what would happen if I typed
other things in here instead of mobileview,
but I want to do that in an automated fashion
where I don't have to just keep generating each request
and checking for the response.
I can go ahead and highlight mobileview right here,
then right-click on it and choose Fuzz.
This brings up the fuzz testing input,
and you can see mobileview is highlighted in green.
And over here in Fuzz Locations, it has that same green.
I'm going to go ahead now
and tell the fuzzer that I want to give it some input.
I'm going to click Payloads here,
and I'm going to add some different payloads.
These payloads are just the input that are going
to be provided to the api.php page
when the fuzz testing begins.
And to keep things simple,
I'm going to choose the simplest type of fuzz testing.
I'm just going to give it a bunch of different strings.
Now, I remember this was an action.
One of the things was mobileview.
That was the valid input
that was generated automatically by the spider.
So I'm just going to try some strings here
that might do something else.
We had mobileview, so maybe we have fullview
or desktopview or browserview.
I'm also going to try,
test is always a good thing to do in your fuzz testing.
Maybe there's a test action
or admin, administrator,
superuser.
I can also try just some random words,
whatever I wanted here, apple, orange, grape.
If I was doing fuzz testing on an application
that I had written, I'd probably have a very long list
of terms based on my knowledge of the application,
but I could also throw in just a standard list of things
that I try all the time.
So we're going to do a short fuzz test here.
We only have about 10 words that we're going to try,
but we could do this with hundreds
or even thousands of different string inputs.
There are other options.
I could've chosen to use a script,
all these different things I mentioned earlier,
file types, regular expressions.
We're going to keep things simple
and do string-based fuzz testing,
where I've told it the strings.
I'm going to click the Add button here
to add those payloads.
Choose OK.
And then all I have to do is click Start Fuzzer.
And what will happen now is Zap is going
to start trying all those different input options.
And you can see down here, it's already completed.
If I scroll up, there's all
of the different things that I tried.
I tried fullview, desktopview, browserview.
All the keywords I specified as string inputs
are displayed as lines down here,
and each one of these lines corresponds to an HTTP request.
We had the original page, that's the top line.
And then the next lines indicate
each one of the fuzzed message types,
where it tried one of my different inputs.
Now, I only tried 10, so there were 11 messages sent,
getting the original page and then the 10
fuzzed options that I gave it.
But if I had specified thousands of choices here,
there would've been thousands of messages sent.
It happens very quickly.
It really rapidly automates this type of testing.
If I choose one of these fuzzed inputs,
you can go up here and see the request and the response.
So let's look at the request first.
This looks very similar to what we started with earlier.
We have the GET command
and then the page, api.php, and then the action.
And instead of mobileview,
this is the one where it said desktopview.
I can click over here then and see what output the
web server provided in response to that.
And you can see here,
there's a whole lot of HTML that came as output.
And I could look at this in my browser.
I could scroll through this and look for abnormal results.
That's a little bit outside of the scope of this video,
but this is the idea of how fuzz testing works,
rapidly testing all sorts of different variations
to see how software responds.
Now, this was a very simple example of fuzzing,
and we only scratched the surface of ZAP,
which is a very valuable code testing tool.
If we were performing a real fuzz test,
we'd spend some time understanding
how the application worked in more detail
and perhaps write some scripts
that generate very realistic input examples
that attempted to break the application security.
One word of caution as we wrap up,
fuzz testing is a very valuable tool
for security professionals,
but it should only be used when you have permission
to perform the test.
Other networks may consider fuzz testing attempts as attacks
and trigger intrusion prevention systems
and other incident response mechanisms.