Description

Fuzzing is an automated process of providing invalid, unexpected and random data to a target program, which is monitored for triggered exceptions such as crashes to find potential security vulnerabilities. Various programs or applications that haven't gone through the SDLC lifecycle in the development process will more likely contain security vulnerabilities.

Fuzzing can be done at various phases of software development, but it usually done before the software goes into production to find and patch security vulnerabilities.

Audience

Fuzzing is a good option for companies wanting to check whether their product contains any security vulnerabilities before shipping it out to the customers. By incorporating fuzzing into the development process, they will release a product that is more stable as well as more secure.

Additional security assessments can be used to advertise the product following the latest security guidelines, but can also be good for overall business as the company won't fall under the spotlight when a critical flaw is found in their software, which could lead to a compromise of a system onto which the software is installed.

Results

The end results include an extensive report about the complete fuzzed software, including

• Basic information about the project scope and timeline.
• Detailed analysis of the fuzzed software, including all the found vulnerabilities.
• Assessment of every found vulnerabilitiey to determine it's risk factor.
• Exploits that demonstrate the criticality of the vulnerability to execute actions on the remote machine.