Topic: Fuzzing in Application Security Testing with Radamsa demo
In this Application Security topic clip, Stefan (@lojikil) and Seth (@sethlaw) discuss fuzzing.
Stefan unveils his handy graph that explains how fuzzing helps developers better understand the domain of their application by demonstrating what inputs an application will and will not accept.
Stefan and Seth then discuss the benefit of having automated fuzzing applications that can create tests against an application. Fuzzers generate mutations that wouldn’t be attempted or imagined by QA or Application Security testers as potential user input that needs to be handled by an application. These unexpected cases from fuzzing tests, as a consequence, reveal information about an application’s domain that can’t be discovered by typical testing.
To illustrate how fuzzers work, Seth then fires up Radamsa (https://gitlab.com/akihe/radamsa), demonstrating how the fuzzing application mutates the string “Hi, Absolute Appsec”.
After this demo, Seth uses Radamsa to mutate Get requests against VTM (Vulnerable Task Manager) a Python-based intentionally vulnerable app. The fuzzing test returns an error within 50 GET requests. lojikil and Seth discuss ways to use Radamsa seeds to replay the error and narrow down which GET requests brought about the application error response.
The mystery isn’t solved during the demo, leaving a chance for Absolute AppSec viewers to send your best guess as to what input created the error response. Winners (or the nth responder) are eligible for sweet, sweet Absolute Appsec swag!