Gray Hat Hacking, Second Edition, 2nd Edition

Chapter 17. Intelligent Fuzzing with Sulley

• Protocol analysis

• Sulley fuzzing framework

  • Powerful fuzzer

  • Process fault detection

  • Network monitoring

  • Session monitoring

In Chapter 14, we have covered basic fuzzing. The problem with basic fuzzing is that you often only scratch the surface of a server’s interfaces and rarely get deep inside the server to find bugs. Most real servers have several layers of filters and challenge/response mechanisms that prevent basic fuzzers from getting very far. Recently, a new type of fuzzing has arrived called intelligent fuzzing. Instead of blindly throwing everything but the kitchen sink at a program, techniques have been developed to analyze how a server works and to customize a fuzzer to get past the filters and ...