Modern Fuzz Testing

Fuzzing is a dynamic testing method used for identifying bugs and vulnerabilities in software. It is mainly used for security and stability testing of the codebase.  

• Fuzzing is an almost completely automated testing approach. 
• Fuzzing can be used for black-box AND white-box testing (on the source code). 
• Fuzzing does not only detect the vulnerabilities but also provides you with the dynamic inputs that caused the error messages. 
• Fuzzing identifies bugs reliably without false positives. 

Fuzz targets are small programs that test predefined API functions, similar to unit tests. However, the inputs are not provided by the developer but produced with the fuzz generators. The generators are responsible for creating random mutations of inputs that are sent to the software under test (SUT). The output of a fuzz generator (i.e. random inputs) is then sent to the SUT. The delivery mechanism processes inputs from fuzz generator and feeds them to SUT for execution.   

Finally, the monitoring system keeps track of how the inputs are executed within SUT and detect triggered bugs, which plays a critical part in the fuzzing process as it also influences what types of vulnerabilities can be discovered during fuzzing.  

If you are looking for a way to secure your software, there are a variety of testing approaches, such as Static Applications Security Testing (SAST), Dynamic Application Security Testing (DAST), Interactive Application Security Testing (IAST), and Feedback-based Application Security Testing (FAST). Each of these methods has its advantages and disadvantages. We have collected some of them in the table below.   

Comparing testing approaches (click to enlarge)

The most common bugs are listed below:  

1. All types of crashes   
2. Memory Leaks   
3. Slow Inputs  
4. Use of uninitialized memory   
5. Data Races   
6. Buffer Overflows   
7. Cross-Site Scripting XSS   
8. Insecure Deserialization   
9. Using Components with Known Vulnerabilities   
10. Insufficient Logging & Monitoring
11. Pointer Issues
12. Injections
    
    See the full list

Developers can benefit from a whole range of open-source fuzzing tools. There are often specialized for specific use cases (e.g. Kernel fuzzing) or programming languages. But there are also a few commercial solutions that become relevant if you're working in larger development teams or DevOps environments. Usually they come with more integrations and features, such as automated bug reporting, CI/CD and dev tool integration, Web API fuzzing, or OWASP vulnerability detection.  

Open Source Fuzzers: 

• AFL++  
• libFuzzer  
• Jazzer 
• Honggfuzz  
• OSS-Fuzz  
• ClusterFuzz  
• Radamsa  
• BFuzz  
• KernelFuzzer  
• Go-fuzz 

• ISO 26262
  Road vehicles – Functional safety
• UNECE WP.29
  United Nations World Forum for Harmonization of Vehicle Regulations
• ISA/IEC 62443-4-1
  Secure product development lifecycle requirements
• ISO/SAE DIS 21434
  Road vehicles — Cybersecurity engineering
• UL2900-1 and UL2900-2-1
  Healthcare and Wellness Systems - Software Cybersecurity for Network-Connectable Products
• ISO/IEC/IEEE 29119
  Software and systems engineering - Software testing
• ISO/IEC 12207
  Systems and software engineering – Software life cycle processes
• ISO 27001
  Information technology – Security techniques – Information security management systems
• ISO 22301
  Security and resilience — Business continuity management systems
• IT-Grundschutz (Germany)
  Based on ISO 27001
• and others