Fuzzing is when random data is thrown at a web application to see what happens next. A Security Fuzzer is a tool designed to provide random data (fuzzing testing) to an application and record the reaction of the application.
In the context of web application testing, fuzzing means testing especially for buffer overflows, parameter validation encoding and error handling.
The results of a fuzzing test reveals application vulnerabilities, which range from juicy stuff, like improper user supplied data sanitizing, failed boundary checks, up to apparently harmless disclosure of application environment details, such as OS version, Application Server version, database details and even private IP disclosure.
Web applications are particularly sensitive to fuzz testing and therefore fuzzers are extensively used by automated web application vulnerability testing scanners and other tools. The process of fuzzing often is based around the following process:
- The application is spidered/crawled and all forms, links and calls to services are extracted.
- The fuzzer creates various test-cases based on the discovered data.
- An analyzer is observing the fuzzier for interesting behavior during the test.