File Fuzzing Using Minifuzz

What is Fuzzing?

Fuzz testing is a testing technique that provides malicious input to the application. Fuzz testing is crashes, assertion failures, and memory leaks when program fails to handle the malicious input. Fuzz testing identifies vulnerabilities which are severe in nature. The typical fuzzing checks the application for buffer overflow, format string vulnerability which can be highly automated.
http://en.wikipedia.org/wiki/Fuzz_testing

Fuzz testing can also be used to find out XSS, Sql injection like vulnerabilities. Google is developing a tool called Lemon which can be used to find out XSS, Sql Injection, HTTP response splitting, Cookie poisoning, Stack trace leaks, Encoding issues and Charset bugs.

For more info: http://itknowledgeexchange.techtarget.com/security-bytes/google-developing-xss-fuzzing-tool-called-lemon/

Fuzzing can have a great impact on the quality of source code.

Example

Below method need to fuzz tested as it accepts the data in the form of given file name.

public static byte[] ReadFile(String FilePath)
{
FileStream fs = new FileStream(FilePath, FileMode.Open, FileAccess.Read,
FileShare.None);
try
{
	int length = (int)fs.Length;
	byte[] data = new byte[length];
	fs.Read(data,0,data.Length);
	// Perform some action with the data read
	return(data);
	}
	catch (Exception)
	{
		return(null);
	}
	finally
{
		fs.Close();
	}
}

Types of Fuzz Testing

Dumb fuzzing:  Randomly changing data and then supplied into an application.
Smart fuzzing : Changing specific data with the knowledge of underlying format the application accepts.

How it works?

The process of fuzz testing is quite simple as described in the below steps.

1. Program accepts the file.
2. Create malformed data.
3. Program accepts the malformed data.
4. If program breaks or unhandled exception occurs, the vulnerability has been found.

Note: Not every unhandled exception/crash is vulnerability. It is a bug. Further analysis can determine if it’s a security bug.

To analyze crashes use !exploitable Crash Analyzer which is the used to automate crash and risk assessment.

Video: http://channel9.msdn.com/posts/PDCNews/Bang-Exploitable-Security-Analyzer/
Download:  http://msecdbg.codeplex.com/

Minifuzz File Fuzzer

Minifuzz tool helps in detecting security flaws that may expose application vulnerabilities in file handling code. The Minifuzz tool accepts the file content and creates a multiple variations of the same file to identify the application behavior for handling different file formats. You should first need to define the file content the application accepts and based on that you should run Minifuzz for the applicable file formats.

It is simple fuzzer designed to ease adoption of fuzz testing by non-security professionals who are not familiar with file fuzzing.

Minifuzz testing must be performed during Microsoft security development lifecycle (SDL) Verification Phase.

Using Minifuzz:

Below is the sample demonstration of MiniFuzz File Fuzzer.
Here we will be fuzzing Agent.exe application. Below is the parameter we need to set in order to perform fuzzing.

Once the fuzzing is started, leave the application to run for at least an hour or two. Minifuzz then creates different variations of the file which is then passed to the application. Security Development Lifecycle (SDL) recommends to test 100,000 patterns for each file format. Below figure shows the different variations of file created by Minifuzz.

Figure below show the file for which the application got crashed.

Same can be seen in log file.

References:

http://www.microsoft.com/security/sdl/default.aspx
http://www.owasp.org/index.php/Fuzzing