Slashdot Mirror
Fuzzing Toolkit For Web Server Testing
prostoalex writes "Dr. Dobb's Journal runs an article discussing the tools necessary for fuzzing (testing a system by generating random input in order to cause program failure or crash). Quoting: 'You are fuzzing a Web server's capability to handle malformed POST data and discover a potentially exploitable memory corruption condition when the 50th test case you sent that crashes the service. You restart the Web daemon and retransmit your last malicious payload, but nothing happens... The issue must rely on some combination of inputs. Perhaps an earlier packet put the Web server in a state that later allowed the 50th test to trigger the memory corruption. We can't tell without further analysis and we can't narrow the possibilities down without the capability of replaying the entire test set in a methodical fashion.'"
OMG ROFLWAFFLE!!!11
This is like using a bump key - hit a lock with random impacts and it opens. Spew enough garbage at a program and it will probably die. Eat enough food you find on the ground and you will probably get sick. Other than getting the +1, Obvious award, whats the point?
I want to delete my account but Slashdot doesn't allow it.
The Chris Benoit / Wikipedia situation? Despite dozens of submissions and tons of mass media coverage, Slashdot will not run a story.
.. or it was some sort of suicide pact, who cares I guess. Should that be included in "news for nerds" ? How about some Paris Hilton stories instead?
Chris Benoit from what little I know is a pro-wrestler that killed his wife & son
If Chris Benoit had difficulty syncing his new iPhone with a computer running 64bit Vista maybe... Frankly, and sad though this case is, just another case of Wiki vandalism would suggest it's hardly /. fodder and that the "tons of mass media coverage" elsewhere is enough to satisfy anyone's interest in the murky world of professional wrestling.
It's not 100%, but if your random number generator (not totally random) started with a random known seed, you might be able to recreate the event.
right up to the point where you included MS Paint in a demo app. Then you landed yourself squarely in crazytown :-P
The concept seems to be a sound one. Sending random input to your web service in a repeatable fashion, but are the tools intuitive? Do they detect the different systems you are running? (ie. an Internet Posting Board) Do they keep track of recent exploits in the wild?
The fact that someone made a Wikipedia entry to the gist of "Chris Benoit missed a match, because of his wife's death" 12 hours before the bodies were found makes this story potentially interesting to /..
That being said, at this point I have not heard antyhing that moves it into the "Why isn't it on /.?" category yet.
The truth is that all men having power ought to be mistrusted. James Madison
How about some Paris Hilton stories instead?
Paris Hilton has Boooobieeees!
And here are the pictures!
Slashdot. News For Nerds.
Affirmative.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
the same editor also vandalized lots of other articles, it's not news if he manages to get one right.
Any program that does this sort of testing should use a good pseudorandom number generator with a very large period and a manually-specifiable seed. If it logs where it's at in the sequence, it makes it easy to repeat a series of tests. Good generators are easy to build - use a big Linear Feedback Shift Register and SHA or MD5 hash the output.
Too bad cmpnet can't host sites. I never made it past all their interstitial ad and popup junk.
And when the one article he did clean up was another wrestler very close to Benoit, and you add in the fact the IP used was from near WWE's headquarters, you don't find it at all interesting?
Also, Slashdot has covered Paris Hilton, when it relates to technology.
.
Watch the video, "Inseminated by Two Black Men", to find out how to combat this blatant trampling of our rights online!
lol. Half an hour ago I ran crashme on my 2.6.18 debian box.
And guess what? It crashed.
Bump Key? That would be the key on a keychain that one uses to take a bump. Remember to dust it off.
that's my word, holla...
Yes, you can tell by experts eyeballing the code. Granted, this might be far more work than automated testing, but it's not like testing is the only way to isolate bugs.
isn't the answer in the summary, that you obviously have it record the input as it goes, so you can literally back up and repeat any given random scenario? Without this capability, it would be like having a 3-year old bash away at the keyboard, they're just as unable to repeat anything.
stuff |
A web application should be cleaning up after each transaction to arrive at a safe state; why wouldn't a web server do the same? If it doesn't, it should.
It's called the internet.
No, it's not a very good way to do a controlled test, but you seriously have to try this at one point in your life. Get a server with a static IP. Run a few normal services on it (Apache and so on). Don't advertise the server or its address anywhere. Give it a few months, and you'll be getting all kinds of unbelievable crap in the likes of access.log. And because you kept your mouth shut about the server, that crap isn't adulterated by so-called "real traffic". It's an awesome sight, and you can learn a lot about what exploit attempts look like, and which ones people are focusing on the most, just by doing this.
OMG PONIES!
Horns are really just a broken halo.
Paris Hilton found God in prison, and will only be showing those from now on if it somehow leads to her curing cancer,
Liberte, Egalite, Fraternite (TM)
Is it just me or does it some obvious that you could just dump the stream then use tcpreplay to send the stream back and anaylze the packets it is sending to the webserver? Pick intervals and ranges of packets send them and see what the webserver does. That seems like a pretty straight forward way to narrow down what is going on.
This article and discussion has been interesting in that it's given me a profound sense of deja vu. Despite being able to hack away in a few software languages (C(++), Java, Perl, Bash scripting, ...), I'm not up to date on the latest and greatest developer tools in this field, so could somebody enlighten me; is this the first widespread deployment of what has previously been called "constrained random stimulus" in the software and web app sphere? We've been using this for years in the ASIC design world, under this name ('constrained random') rather than 'fuzzing'. Basically, the idea is that in *hardware*, most "execution paths" on the chip get exercised (nearly) every clock cycle, which could translate into quadrillions or more times over the life of each ASIC (if you run 10 million of a product nonstop at 1GHz for 3 years, this is ~10^24 cycles). This, along with the increased difficulty and cost of changing the mask set after artwork release (compared to a software patch), means that verification must be carried out from a different perspective. I'm aware that many software projects are very careful to test every single obscure corner case in every regression set, but in hardware this *must* be done at all times, on all projects to have a prayer of releasing first-time-right silicon. To this end, we need to employ the pseudorandom generation capabilities of computers to apply stimuli that exercise corner cases humans may never be able to think of. As in software, we need *constrained* random because truly random input has a *much* longer time to convergence because the real stimulus is far from random; it is somewat random within a well-defined range of allowed values and sequences. For a long time, we wrote C, Perl, and Verilog/VHDL code that generated random stimuli and constrained them appropriately within the range of the appropriate state machines, protocols, etc.. When SystemVerilog was introduced a few years ago, one of the main features that it offers (besides much more OOP-like constructs for design and verification) is a constraint solver, where you are able to code in the constraints in a very high-level manner, and have the simulator generate random numbers and fit them to the constraints you have specified before applying them to the DUT. By doing this, you reduce your convergence time from millions of years (with pure-random stimulus) to something on a more human timescale, for non-trivial designs. Remember, the state space is exponential!
Anyway, 'fuzzing' is an interesting topic, just thought I'd play 'Old Man ASIC' and repeat the truism that there's nothing new under the sun. Oh.. and.. YOU DAMN KIDS GET OFF MY LAWN!
The thing that irritates me most are the sites that have 5,478 *different* links. Even on broadband, they take tens of seconds, sometimes over a minute, to load. I'd like one *standard* test to be that they try surfing, like 50% of the US public does, on dialup.
I won't even start on the idiots who have no compression on their cameras, and put jpgs up on their Websites that are over a meg....
mark
I do what to servers?....
Ya, and people should always wear their seatbelts, never drink and drive, and floss everytime they brush their teeth; Yet, the majority of humans fail to abide by these 3 simple "should haves".
Maybe you should write a howto covering how you think a web server should behave, and then proceed to write your own implementation from scratch (for my network programming class I had to do this, in C++ with my own sockets library).
Oh, and nevermind the fact that the web server may not have any state information.
I'm sure you're just another troll or BOFH wannabe anyways.
c'ya and good luck, buck.
--
wi-fizzle research, straight outta oakland
Censorship is obscene. Patriotism is bigotry. Faith is a vice. Slashdot 2.0 sucks.