3 ms·
I'd suggest looking into fuzzers. Short version - tools designed to input messy, non-conforming data to ensure the inputs don't cause problems, that things are
by sophacles 13y ago
I'd suggest looking into fuzzers. Short version - tools designed to input messy, non-conforming data to ensure the inputs don't cause problems, that things are sanitized correctly, etc. At this point they are a mature technology, with improvements constantly being researched. They are generally thought of as security tools[1], but are very useful for basic development too.
[1] The common use of fuzzers in a security context is to send malformed packets to protocol parsers to see if they fall over or cause buffer overruns, or otherwise do fun things in the context of exploiting a system. Another common one being automatic sql-injection discovery tools.
- Arnor 13y agoA quick search gave me this list: http://www.infosecinstitute.com/blog/2005/12/fuzzers-ultimate-list.html http://www.infosecinstitute.com/blog/2005/12/fuzzers-ultimat... is there a notable fuzzer missing? It's a pretty long list, does anyone know which of these tools are really worth checking out?
- juhanima 13y agoThat's a pretty old list. Just to name one, I would recommend taking a look of Radamsa https://www.ee.oulu.fi/research/ouspg/Radamsa https://www.ee.oulu.fi/research/ouspg/Radamsa ...from the Oulu University. It's more like a framework for generating intelligent fuzzers than a shrink-wrapped product, though. The OUSPG guys are really good at fuzzing. There is also a commercial spin-off, Codenomicon, whose tools are quite widely used.
- alecdbrooks 13y agoCrude fuzzing can be done on the command line using dd. The command "dd if=/dev/urandom bs=1000 count=1" will spit out 1 KB of psuedorandom data you can pipe, POST or otherwise send to your application. (GNU's implementation lets you use "1K" as well.)