Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

Fuzz Testing as defined by Wikipedia is:

a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer program. The program is then monitored for exceptions such as crashes or failing built-in code assertions. Fuzzing is commonly used to test for security problems in software or computer systems.

I was wondering what kind of fuzzzing packages people have been using with Ruby/JavaScript/Python. One element that is gaining more traction at our shop is the idea of pushing in more penetration testing into our QA cycles.

share|improve this question
2  
"Good" is a subjective term. Would it be better to just simply ask "What tools are available for fuzz testing with Ruby, JavaScript or Python?" –  TristaanOgre May 20 '11 at 19:48
    
Edited as mentioned. –  terryp May 20 '11 at 19:50
1  
What are you fuzzing? Files, protocols? What sorts of streams does the application you are testing consume? –  Alan May 20 '11 at 19:56
2  
Don't mind me. I'm just kind of smiling because professionals are using the term 'fuzzing' and it sounds funny. :-) –  corsiKa May 20 '11 at 20:13
add comment

2 Answers

Burp Suite would be worth checking out if you're fuzz testing web applications. As the name implies, it's actually a suite of different web security testing tools - I used it for the first time on Monday in a pen testing workshop and it seems like a tremendously useful tool. Burp Intruder is the tool used for fuzzing attacks - and here's a video tutorial that covers Burp Repeater and Intruder.

There's also Peach, which is written in Python but the next version is being rewritten in C#. This seems to be more broadly applicable. (As you can tell from the "seems", I haven't used this much - it's just in my list of tools we considered for a Weekend Testing session but never got time to put together a good session for).

share|improve this answer
add comment

I haven't used it myself (although I plan to on my side-project when I get it to private alpha stage) but I think Hexawise would be able to do some of this. You can tweak the phasing parameters (2 pairwise, 3 pairwise, I think it goes up to 6) and it will generate values in certain ranges. This should be pretty close to what you're looking to do. You can also set the variation in the test data, so that should help with your 'fuzzing'.

Again, I haven't used it myself, but I do hope to in the near future, because it looks like a promising tool. It's also free for commercial purposes as a trial for the first 5 users, but the trail version appears unlimited except in number of users, and you can't host it yourself unless you upgrade.

share|improve this answer
1  
I don't know that Hexawise does fuzzing - I thought it was purely for combinatoric test generation. –  Alan May 20 '11 at 20:29
    
It doesn't directly do fuzzing. But, by regenerating the values with a high variation modifier, you should end up with a similar result to fuzzing. –  corsiKa May 20 '11 at 20:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.