NMON Network Monitoring: Books: Fuzzing: Brute Force Vulnerability Discovery

Authors: Michael Sutton, Adam Greene, Pedram Amini
Publisher: Addison-Wesley Professional
Category: Book

List Price: ~~$54.99~~
Buy New: $31.39
You Save: $23.60 (43%)
Buy New/Used from $31.39

Avg. Customer Rating: 4.5 out of 5 stars

(4 reviews)
Sales Rank: 442493

Languages: English (Original Language), English (Unknown), English (Published)
Media: Paperback
Edition: 1
Number Of Items: 1
Pages: 576
Shipping Weight (lbs): 1.8
Dimensions (in): 9 x 6.8 x 1.2

ISBN: 0321446119
Dewey Decimal Number: 005.8
EAN: 9780321446114
ASIN: 0321446119

Publication Date: July 9, 2007
Availability: Usually ships in 1-2 business days

Similar Items:

•	The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws
•	The Shellcoder's Handbook: Discovering and Exploiting Security Holes
•	Virtual Honeypots: From Botnet Tracking to Intrusion Detection
•	Hacking: The Art of Exploitation, 2nd Edition
•	The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities

Editorial Reviews:

Product Description

FUZZING

Master One of Today?s Most Powerful Techniques for Revealing Security Flaws!

Fuzzing has evolved into one of today?s most effective approaches to test software security. To ?fuzz,? you attach a program?s inputs to a source of random data, and then systematically identify the failures that arise. Hackers have

relied on fuzzing for years: Now, it?s your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.

Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:

? Why fuzzing simplifies test design and catches flaws other methods miss

? The fuzzing process: from identifying inputs to assessing ?exploitability?

? Understanding the requirements for effective fuzzing

? Comparing mutation-based and generation-based fuzzers

? Using and automating environment variable and argument fuzzing

? Mastering in-memory fuzzing techniques

? Constructing custom fuzzing frameworks and tools

? Implementing intelligent fault detection

Attackers are already using fuzzing. You should, too. Whether you?re a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.

Foreword xix

Preface xxi

Acknowledgments xxv

About the Author xxvii

PARTI BACKGROUND 1

Chapter 1 Vulnerability Discovery Methodologies 3

Chapter 2 What Is Fuzzing? 21

Chapter 3 Fuzzing Methods and Fuzzer Types 33

Chapter 4 Data Representation and Analysis 45

Chapter 5 Requirements for Effective Fuzzing 61

PART II TARGETS AND AUTOMATION 71

Chapter 6 Automation and Data Generation 73

Chapter 7 Environment Variable and Argument Fuzzing 89

Chapter 8 Environment Variable and Argument Fuzzing: Automation 103

Chapter 9 Web Application and Server Fuzzing 113

Chapter 10 Web Application and Server Fuzzing: Automation 137

Chapter 11 File Format Fuzzing 169

Chapter 12 File Format Fuzzing: Automation on UNIX 181

Chapter 13 File Format Fuzzing: Automation on Windows 197

Chapter 14 Network Protocol Fuzzing 223

Chapter 15 Network Protocol Fuzzing: Automation on UNIX 235

Chapter 16 Network Protocol Fuzzing: Automation on Windows 249

Chapter 17 Web Browser Fuzzing 267

Chapter 18 Web Browser Fuzzing: Automation 283

Chapter 19 In-Memory Fuzzing 301

Chapter 20 In-Memory Fuzzing: Automation 315

PART III ADVANCED FUZZING TECHNOLOGIES 349

Chapter 21 Fuzzing Frameworks 351

Chapter 22 Automated Protocol Dissection 419

Chapter 23 Fuzzer Tracking 437

Chapter 24 Intelligent Fault Detection 471

PART IV LOOKING FORWARD 495

Chapter 25 Lessons Learned 497

Chapter 26 Looking Forward 507

Index 519

Customer Reviews:

4 out of 5 stars

Excellent introduction to fuzzing February 18, 2008
2 out of 2 found this review helpful

Perhaps a more appropriate title would be: "Fuzzing for Dummies" or "Fuzzing 101"- but I mean this in a really good way. Why I say this is because of how the book is set up, starting with the background history of fuzzing, and many variations of what fuzzing really is. These are excellent so those who may not have this background don't jump in blindly to this area. For example, Chapter 3 goes into the Fuzzing Methods and Chapter 4 discusses Data Representation. While not lengthy discussions, they are good to set up for the actual doing part in the rest of the book

I liked that the book starts out with what fuzzing is good for, the steps that you have to take for it to be successful, and what fuzzing is not good at. It explains how vectors like access control issues, and design flaws fit into this category. Knowing this up front saves a lot of head banging later on down the road. It's also good that the authors point out that they are merely defining fuzzing in their specific realm: talk to others and you are going to find a whole different explanation. This is OK though- most of the security industry is like that.

Part II of the book starts to get into the heart of things, discussing the components required for fuzzing, more details into the tool they built called "WebFuzz" and then dive into the tests themselves. The author's openness in telling us what they did, then how it works, then tell you all the things to make it better makes this book even more valuable. Good efforts to share useful things and make them a community effort with proper guidance are never a bad thing. Plus, if you are interested in helping, this guidance gives you somewhere to start.

Essentially, this book gives you the blueprint of fuzzing and a bunch of ideas on how to get started down a more advanced path. Well written with good explanations of how the authors got where they got to as well a useful tool to get you started (located on their companion website), this book gives you the toolkit of building blocks for your future fuzzing endeavors.

5 out of 5 stars

_The_ fuzzing book December 31, 2007
0 out of 1 found this review helpful

Alright, the title cannot be more straightforward. This is basically _the_ book on fuzzing, a vulnerability discovery methodology, covering several fuzzing methods such as env variable and argv variable fuzzing, web, file format, network protocol, etc (more on the table of contents).

The book itself is very well structured. Starts with an introduction to fuzzing with some history, presenting the different types of fuzzing methods and fuzzers in part one of the book. Next, every fuzzing method is covered. First, some theory on a particular method is presented. Afterwards, the book gets into action, explaining how to carry on the fuzz previously covered. Some methods are approached differently on Windows and Linux platforms, so the author will dedicate a chapter to each of these.

I haven't finished the book yet, but so far, I would say having some knowledge on C/C++ definitely helps. I would say it's recommended for the reader to know C/C++ or at least be familiarized with a programming language to follow the book with ease.

I've seen other books where explanations and source codes are misplaced and do not match; well, not in this one. As I said before, it is very well structured, and the editing and revision looks thoughtfully elaborated.

Before buying this book I took a really deep thought about what does a bear and a fish on the cover have to do with software security and fuzzing. Well, don't let the cover fool you. The contents of the book are really good. Actually, after reading the first couple chapters, you'll get to know the meaning of the cover and will love it.

Also, it is important to mention that this book is not one of those "all-in-one bundle of articles stacked up and stapled together". I would say this book is more of a complete tutorial for the newbie and a reference for the already-knowledgeable expert. I am a newbie in this topic and this book is making the journey a very pleasant experience.

5 out of 5 stars

Great book August 29, 2007
4 out of 11 found this review helpful

In this book the authors do a number of things that are worth reading:
o Document how and why SPIKE works (and implement their own block-based fuzzer sulley)
o Go through the process of writing a .flv fuzzer
o Go through the process of writing a Python ActiveX fuzzer, which was probably my favorite part.
o Talk about the downsides of various kinds of fuzzing. For example, when is fuzzing with a genetic algorithm not the right thing to do?

That alone made this a great book.

4 out of 5 stars

Great on Theory...Pretty Good on Execution July 29, 2007
15 out of 16 found this review helpful

I anxiously awaited reading and putting this book to use. Fuzzing is one of those "mystical" concepts that the people cranking out exploits were doing and I wanted to be able to use some of the publicly available fuzzers to fuzz for vulnerabilities and join the ranks.

From the back cover: "...Now, its your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does."

I thought the book excellently covered the theory portions of fuzzing. The format of theory/background of a fuzzing method (Environment Variable and Argument Fuzzing, Web Application and Server fuzzing, File Format Fuzzing, Network Protocol Fuzzing, Web Browser Fuzzing, and In-Memory Fuzzing) followed with that fuzzing method Automation or on Unix and then on Windows worked perfectly. It was a good structure and informative. The Automation or Unix and Windows sections fit in well with the theory sections before it.

I think the book falls a bit short on practical execution (case studies) of using the fuzzing tools. Granted I say this based on my own expectations of what I would like to see from a fuzzing book but also from what the authors say in the preface that we will get out of the book. They say, "We detail numerous vulnerabilities throughout the book and discuss how they might have been identifies through fuzzing." Some of the case studies are exactly what I expected like case studies in Chapter 10, the fuzzing with SPIKE section in Chapter 15, and the Complete Walkthru with Sulley in Chapter 21. Some of the others fall a bit short. I expected a lot more out of the ActiveX fuzzing sections (chapter 18), the Shockwave Flash example in Chapter 21 was useful for the discussion of creating a test case for a protocol but after 11 pages of mostly code in the last section we basically get told to load it into PaiMei and "go fuzz", and while the theory parts of chapter's 7 & 8 were great, telling me to find an AIX 5.3 box to see some example environment variables and argument vulnerabilities was less than useful. It would have been much more useful to use some of today's fuzzing tools to find some old vulnerabilities in something like *BSD or old RedHat distributions, something I might have in the lab or at least something I could install in VMWare.

Likes: Theory, background, discussion of how and why they built the "author built" fuzzers they cover in the book, some of the case studies gave me everything I needed to reproduce on my own in the lab. Providing the fuzzers on the companion website was great as well. The George Bush quotes were hilarious as well and made me look forward to each chapter so I could get another quote.

Dislikes: some of the case studies I don't think went into enough detail (no step by step instructions), I think the explanations of the blocks of code could have been better and numbering lines so we could refer to them in the text would have helped. The discussion of the existing frameworks was a little bit light (but we do get told to go the companion website for more info). Ideally we would have walked thru a couple of easy examples using multiple fuzzer frameworks to get us from advisory to EIP= 0x41414141. That would have been nice to see.

Overall a great book, it has a place on the bookshelf next to shellcoder's handbook and some other programming books and it will be used (many times) as a reference to play with the various fuzzers available out there.

For your safety and security, orders are processed through amazon.com