17

Fuzz Testing as defined by Wikipedia is:

a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer program. The program is then monitored for exceptions such as crashes or failing built-in code assertions. Fuzzing is commonly used to test for security problems in software or computer systems.

I was wondering what kind of fuzzzing packages people have been using with Ruby/JavaScript/Python. One element that is gaining more traction at our shop is the idea of pushing in more penetration testing into our QA cycles.

4
  • 2
    "Good" is a subjective term. Would it be better to just simply ask "What tools are available for fuzz testing with Ruby, JavaScript or Python?" May 20, 2011 at 19:48
  • Edited as mentioned.
    – terryp
    May 20, 2011 at 19:50
  • 1
    What are you fuzzing? Files, protocols? What sorts of streams does the application you are testing consume?
    – Alan
    May 20, 2011 at 19:56
  • 2
    Don't mind me. I'm just kind of smiling because professionals are using the term 'fuzzing' and it sounds funny. :-)
    – corsiKa
    May 20, 2011 at 20:13

3 Answers 3

10

Burp Suite would be worth checking out if you're fuzz testing web applications. As the name implies, it's actually a suite of different web security testing tools - I used it for the first time on Monday in a pen testing workshop and it seems like a tremendously useful tool. Burp Intruder is the tool used for fuzzing attacks - and here's a video tutorial that covers Burp Repeater and Intruder.

There's also Peach, which is written in Python but the next version is being rewritten in C#. This seems to be more broadly applicable. (As you can tell from the "seems", I haven't used this much - it's just in my list of tools we considered for a Weekend Testing session but never got time to put together a good session for).

1
  • 2
    Burp is a great tool and does a ton of cool things. OWASP ZAP also does quite a few and may be worth checking out.
    – maznika
    Aug 2, 2014 at 0:04
3

I haven't used it myself (although I plan to on my side-project when I get it to private alpha stage) but I think Hexawise would be able to do some of this. You can tweak the phasing parameters (2 pairwise, 3 pairwise, I think it goes up to 6) and it will generate values in certain ranges. This should be pretty close to what you're looking to do. You can also set the variation in the test data, so that should help with your 'fuzzing'.

Again, I haven't used it myself, but I do hope to in the near future, because it looks like a promising tool. It's also free for commercial purposes as a trial for the first 5 users, but the trail version appears unlimited except in number of users, and you can't host it yourself unless you upgrade.

2
  • 1
    I don't know that Hexawise does fuzzing - I thought it was purely for combinatoric test generation.
    – Alan
    May 20, 2011 at 20:29
  • It doesn't directly do fuzzing. But, by regenerating the values with a high variation modifier, you should end up with a similar result to fuzzing.
    – corsiKa
    May 20, 2011 at 20:34
-1

I'd hit up Codenomicon Defensics. They discovered Heartbleed so u know they're legit.

1
  • 2
    Could you elaborate on this? What tool are we looking at here?
    – corsiKa
    Jul 29, 2014 at 2:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.