Eight years ago, Addie Webster was the victim of the most notorious kidnapping of the decade. Addie vanished—and her high-profile parents were forced to move on. Mark Webster is now president of the United States, fighting to keep the oval office after a tumultuous first term. Then the unthinkable happens: the president's daughter resurfaces. Addie is brought back into her family's fold, but who is this sixteen-year-old girl with a quiet, burning intelligence now living in the White House? There are those in the president's political circle who find her timely return suspicious. When a national security advisor approaches Darrow Fergusson, Addie's childhood best friend and the son of the president's chief of staff, he doesn't know what to think. How could the girl he's missed for all these years be a threat to national security? Still, at the risk of having his own secrets exposed, Darrow agrees to spy on Addie. He soon realizes that his old friend is much more than the traumatized victim of a sick political fringe group. Addie has come with a mission…but will she choose to complete it?
The realistic portrayals of researching, developing, and ultimately defending the Internet from a malicious “Zero-Day” attack will appeal to every corner of the IT community. Although finctional, the numerous accounts of real events and references to real people will ring true with every member of the security community. This book will also satisfy those not on the “inside” of this community, who are fascinated by the real tactics and motives of criminal, malicous hackers and those who defent the Internet from them.
* The realistic portrayals of researching, developing, and ultimately defending the Internet from a malicious “Zero-Day” attack will appeal to every corner of the IT community.
* This book will entertain, educate, and enlighten the security and IT community about the world of elite security professionals who safeguard the Internet from the most dangerous cyber criminals and terrorists.
* Although finctional, the numerous accounts of real events and references to real people will ring true with every member of the security community.
Master One of Today’s Most Powerful Techniques for Revealing Security Flaws!
Fuzzing has evolved into one of today’s most effective approaches to test software security. To “fuzz,” you attach a program’s inputs to a source of random data, and then systematically identify the failures that arise. Hackers have relied on fuzzing for years: Now, it’s your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.
Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:
• Why fuzzing simplifies test design and catches flaws other methods miss
• The fuzzing process: from identifying inputs to assessing “exploitability”
• Understanding the requirements for effective fuzzing
• Comparing mutation-based and generation-based fuzzers
• Using and automating environment variable and argument fuzzing
• Mastering in-memory fuzzing techniques
• Constructing custom fuzzing frameworks and tools
• Implementing intelligent fault detection
Attackers are already using fuzzing. You should, too. Whether you’re a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.
About the Author xxvii
PARTI BACKGROUND 1
Chapter 1 Vulnerability Discovery Methodologies 3
Chapter 2 What Is Fuzzing? 21
Chapter 3 Fuzzing Methods and Fuzzer Types 33
Chapter 4 Data Representation and Analysis 45
Chapter 5 Requirements for Effective Fuzzing 61
PART II TARGETS AND AUTOMATION 71
Chapter 6 Automation and Data Generation 73
Chapter 7 Environment Variable and Argument Fuzzing 89
Chapter 8 Environment Variable and Argument Fuzzing: Automation 103
Chapter 9 Web Application and Server Fuzzing 113
Chapter 10 Web Application and Server Fuzzing: Automation 137
Chapter 11 File Format Fuzzing 169
Chapter 12 File Format Fuzzing: Automation on UNIX 181
Chapter 13 File Format Fuzzing: Automation on Windows 197
Chapter 14 Network Protocol Fuzzing 223
Chapter 15 Network Protocol Fuzzing: Automation on UNIX 235
Chapter 16 Network Protocol Fuzzing: Automation on Windows 249
Chapter 17 Web Browser Fuzzing 267
Chapter 18 Web Browser Fuzzing: Automation 283
Chapter 19 In-Memory Fuzzing 301
Chapter 20 In-Memory Fuzzing: Automation 315
PART III ADVANCED FUZZING TECHNOLOGIES 349
Chapter 21 Fuzzing Frameworks 351
Chapter 22 Automated Protocol Dissection 419
Chapter 23 Fuzzer Tracking 437
Chapter 24 Intelligent Fault Detection 471
PART IV LOOKING FORWARD 495
Chapter 25 Lessons Learned 497
Chapter 26 Looking Forward 507
1. Coding – The ability to program and script is quickly becoming a mainstream requirement for just about everyone in the security industry. This section covers the basics in coding complemented with a slue of programming tips and tricks in C/C++, Java, Perl and NASL.
2. Sockets – The technology that allows programs and scripts to communicate over a network is sockets. Even though the theory remains the same – communication over TCP and UDP, sockets are implemented differently in nearly ever language.
3. Shellcode – Shellcode, commonly defined as bytecode converted from Assembly, is utilized to execute commands on remote systems via direct memory access.
4. Porting – Due to the differences between operating platforms and language implementations on those platforms, it is a common practice to modify an original body of code to work on a different platforms. This technique is known as porting and is incredible useful in the real world environments since it allows you to not “recreate the wheel.”
5. Coding Tools – The culmination of the previous four sections, coding tools brings all of the techniques that you have learned to the forefront. With the background technologies and techniques you will now be able to code quick utilities that will not only make you more productive, they will arm you with an extremely valuable skill that will remain with you as long as you make the proper time and effort dedications.
*Contains never before seen chapters on writing and automating exploits on windows systems with all-new exploits.
*Perform zero-day exploit forensics by reverse engineering malicious code.
*Provides working code and scripts in all of the most common programming languages for readers to use TODAY to defend their networks.
“A fascinating look at the new direction fuzzing technology is taking — useful for both QA engineers and bug hunters alike!”
—Dave Aitel, CTO, Immunity Inc.
Learn the code cracker's malicious mindset, so you can find worn-size holes in the software you are designing, testing, and building. Fuzzing for Software Security Testing and Quality Assurance takes a weapon from the black-hat arsenal to give you a powerful new tool to build secure, high-quality software. This practical resource helps you add extra protection without adding expense or time to already tight schedules and budgets. The book shows you how to make fuzzing a standard practice that integrates seamlessly with all development activities.
This comprehensive reference goes through each phase of software development and points out where testing and auditing can tighten security. It surveys all popular commercial fuzzing tools and explains how to select the right one for a software development project. The book also identifies those cases where commercial tools fall short and when there is a need for building your own fuzzing tools.