Fuzzing: Brute Force Vulnerability Discovery (Paperback)

Michael Sutton, Adam Greene, Pedram Amini

  • 出版商: Addison Wesley
  • 出版日期: 2007-07-01
  • 售價: $2,200
  • 貴賓價: 9.5$2,090
  • 語言: 英文
  • 頁數: 576
  • 裝訂: Paperback
  • ISBN: 0321446119
  • ISBN-13: 9780321446114
  • 相關分類: 資訊安全軟體測試駭客 Hack
  • 立即出貨(限量) (庫存=1)

買這商品的人也買了...

商品描述

Description 

FUZZING

Master One of Today’s Most Powerful Techniques for Revealing Security Flaws!

Fuzzing has evolved into one of today’s most effective approaches to test software security. To “fuzz,” you attach a program’s inputs to a source of random data, and then systematically identify the failures that arise. Hackers have

relied on fuzzing for years: Now, it’s your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.

 

Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:

 

• Why fuzzing simplifies test design and catches flaws other methods miss

• The fuzzing process: from identifying inputs to assessing “exploitability”

• Understanding the requirements for effective fuzzing

• Comparing mutation-based and generation-based fuzzers

• Using and automating environment variable and argument fuzzing

• Mastering in-memory fuzzing techniques

• Constructing custom fuzzing frameworks and tools

• Implementing intelligent fault detection

 

Attackers are already using fuzzing. You should, too. Whether you’re a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.

Table of Contents

Foreword     xix

Preface        xxi

Acknowledgments  xxv

About the Author   xxvii

PARTI         BACKGROUND     1

Chapter 1    Vulnerability Discovery Methodologies  3

Chapter 2    What Is Fuzzing?   21

Chapter 3    Fuzzing Methods and Fuzzer Types     33

Chapter 4    Data Representation and Analysis        45

Chapter 5    Requirements for Effective Fuzzing      61

PART II      TARGETS AND AUTOMATION          71

Chapter 6    Automation and Data Generation        73

Chapter 7    Environment Variable and Argument Fuzzing 89

Chapter 8    Environment Variable and Argument Fuzzing: Automation 103

Chapter 9    Web Application and Server Fuzzing     113

Chapter 10  Web Application and Server Fuzzing: Automation    137

Chapter 11  File Format Fuzzing         169

Chapter 12  File Format Fuzzing: Automation on UNIX     181

Chapter 13  File Format Fuzzing: Automation on Windows         197

Chapter 14  Network Protocol Fuzzing         223

Chapter 15  Network Protocol Fuzzing: Automation on UNIX     235

Chapter 16  Network Protocol Fuzzing: Automation on Windows         249

Chapter 17  Web Browser Fuzzing      267

Chapter 18  Web Browser Fuzzing: Automation     283

Chapter 19  In-Memory Fuzzing         301

Chapter 20  In-Memory Fuzzing: Automation         315

PART III    ADVANCED FUZZING TECHNOLOGIES      349

Chapter 21  Fuzzing Frameworks       351

Chapter 22  Automated Protocol Dissection  419

Chapter 23  Fuzzer Tracking     437

Chapter 24  Intelligent Fault Detection 471

PART IV     LOOKING FORWARD    495

Chapter 25  Lessons Learned    497

Chapter 26  Looking Forward    507

Index 519

商品描述(中文翻譯)

描述

模糊測試(Fuzzing)已經成為當今最有效的軟體安全測試方法之一。在模糊測試中,您將一個程式的輸入連接到隨機數據源,然後系統地識別出產生的錯誤。黑客多年來一直依賴模糊測試,現在輪到您了。在這本書中,著名的模糊測試專家將向您展示如何在他人之前使用模糊測試來揭示軟體中的弱點。

《模糊測試》是第一本也是唯一一本從頭到尾介紹模糊測試的書籍,將紀律性的最佳實踐帶入了這一傳統上以非正式方式實施的技術中。作者首先回顧了模糊測試的工作原理,並概述了它相對於其他安全測試方法的重要優勢。接下來,他們介紹了用於發現網絡協議、文件格式和網絡應用程式漏洞的最新模糊測試技術;演示了使用自動化模糊測試工具;並呈現了幾個有洞察力的案例研究,展示了模糊測試的應用。內容包括:

- 模糊測試簡化測試設計並捕捉其他方法忽略的缺陷的原因
- 模糊測試過程:從識別輸入到評估“可利用性”
- 了解有效模糊測試的要求
- 比較基於突變和生成的模糊測試工具
- 使用和自動化環境變數和參數的模糊測試
- 掌握內存模糊測試技術
- 構建自定義模糊測試框架和工具
- 實施智能故障檢測

攻擊者已經開始使用模糊測試,您也應該這樣做。無論您是開發人員、安全工程師、測試人員還是質量保證專家,本書都將教您如何構建安全的軟體。

目錄

前言
致謝
關於作者
第一部分:背景
第1章:漏洞發現方法論
第2章:```