Fuzzing: Brute Force Vulnerability Discovery and over one million other books are available for Amazon Kindle. Learn more
Qty:1
  • List Price: $59.99
  • Save: $19.37 (32%)
Only 1 left in stock (more on the way).
Ships from and sold by Amazon.com.
Gift-wrap available.
Fuzzing: Brute Force Vuln... has been added to your Cart
+ $3.99 shipping
Used: Very Good | Details
Sold by azulyoro56
Condition: Used: Very Good
Comment: Clean pages. Clean cover. Good spine. Overall a nice copy.
Access codes and supplements are not guaranteed with used items.
Sell yours for a Gift Card
We'll buy it for $16.38
Learn More
Trade in now
Have one to sell? Sell on Amazon
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See this image

Fuzzing: Brute Force Vulnerability Discovery Paperback – July 9, 2007

ISBN-13: 978-0321446114 ISBN-10: 0321446119 Edition: 1st

Buy New
Price: $40.62
30 New from $36.04 21 Used from $33.58
Amazon Price New from Used from
Kindle
"Please retry"
Paperback
"Please retry"
$40.62
$36.04 $33.58
Free%20Two-Day%20Shipping%20for%20College%20Students%20with%20Amazon%20Student


Get Up to 80% Back When You Sell Us Your Books
$40.62 FREE Shipping. Only 1 left in stock (more on the way). Ships from and sold by Amazon.com. Gift-wrap available.

Frequently Bought Together

Fuzzing: Brute Force Vulnerability Discovery + A Bug Hunter's Diary: A Guided Tour Through the Wilds of Software Security + The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities
Price for all three: $119.44

Buy the selected items together
NO_CONTENT_IN_FEATURE

Shop the New Digital Design Bookstore
Check out the Digital Design Bookstore, a new hub for photographers, art directors, illustrators, web developers, and other creative individuals to find highly rated and highly relevant career resources. Shop books on web development and graphic design, or check out blog posts by authors and thought-leaders in the design industry. Shop now

Product Details

  • Paperback: 576 pages
  • Publisher: Addison-Wesley Professional; 1 edition (July 9, 2007)
  • Language: English
  • ISBN-10: 0321446119
  • ISBN-13: 978-0321446114
  • Product Dimensions: 6.9 x 1.3 x 9.1 inches
  • Shipping Weight: 1.6 pounds (View shipping rates and policies)
  • Average Customer Review: 4.2 out of 5 stars  See all reviews (4 customer reviews)
  • Amazon Best Sellers Rank: #379,772 in Books (See Top 100 in Books)

Editorial Reviews

From the Back Cover

FUZZING

Master One of Today's Most Powerful Techniques for Revealing Security Flaws!

Fuzzing has evolved into one of today's most effective approaches to test software security. To “fuzz, you attach a program's inputs to a source of random data, and then systematically identify the failures that arise. Hackers have

relied on fuzzing for years: Now, it's your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.

 

Fuzzingis the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:

 

• Why fuzzing simplifies test design and catches flaws other methods miss

• The fuzzing process: from identifying inputs to assessing “exploitability

• Understanding the requirements for effective fuzzing

• Comparing mutation-based and generation-based fuzzers

• Using and automating environment variable and argument fuzzing

• Mastering in-memory fuzzing techniques

• Constructing custom fuzzing frameworks and tools

• Implementing intelligent fault detection

 

Attackers are already using fuzzing. You should, too. Whether you're a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.

 

Foreword     xix

Preface        xxi

Acknowledgments  xxv

About the Author   xxvii

PARTI         BACKGROUND     1

Chapter 1    Vulnerability Discovery Methodologies  3

Chapter 2    What Is Fuzzing?   21

Chapter 3    Fuzzing Methods and Fuzzer Types     33

Chapter 4    Data Representation and Analysis        45

Chapter 5    Requirements for Effective Fuzzing      61

PART II      TARGETS AND AUTOMATION          71

Chapter 6    Automation and Data Generation        73

Chapter 7    Environment Variable and Argument Fuzzing 89

Chapter 8    Environment Variable and Argument Fuzzing: Automation 103

Chapter 9    Web Application and Server Fuzzing     113

Chapter 10  Web Application and Server Fuzzing: Automation    137

Chapter 11  File Format Fuzzing         169

Chapter 12  File Format Fuzzing: Automation on UNIX     181

Chapter 13  File Format Fuzzing: Automation on Windows         197

Chapter 14  Network Protocol Fuzzing         223

Chapter 15  Network Protocol Fuzzing: Automation on UNIX     235

Chapter 16  Network Protocol Fuzzing: Automation on Windows         249

Chapter 17  Web Browser Fuzzing      267

Chapter 18  Web Browser Fuzzing: Automation     283

Chapter 19  In-Memory Fuzzing         301

Chapter 20  In-Memory Fuzzing: Automation         315

PART III    ADVANCED FUZZING TECHNOLOGIES      349

Chapter 21  Fuzzing Frameworks       351

Chapter 22  Automated Protocol Dissection  419

Chapter 23  Fuzzer Tracking     437

Chapter 24  Intelligent Fault Detection 471

PART IV     LOOKING FORWARD    495

Chapter 25  Lessons Learned    497

Chapter 26  Looking Forward    507

Index 519

 

 

About the Author

M ICHAEL S UTTON

Michael Sutton is the Security Evangelist for SPI Dynamics. As Security Evangelist, Michael is responsible for identifying, researching, and presenting on emerging issues in the web application security industry. He is a frequent speaker at major information security conferences, has authored numerous articles, and is regularly quoted in the media on various information security topics.Michael is also a member of the Web Application Security Consortium (WASC), where he is project lead for the Web Application Security Statistics project.

Prior to joining SPI Dynamics,Michael was a Director for iDefense/VeriSign, where he headed iDefense Labs, a team of world class researchers tasked with discovering and researching security vulnerabilities.Michael also established the Information Systems Assurance and Advisory Services (ISAAS) practice for Ernst & Young in Bermuda. He holds degrees from the University of Alberta and The George Washington University. Michael is a proud Canadian who understands that hockey is a religion and not a sport. Outside of the office, he is a Sergeant with the Fairfax Volunteer Fire Department.

 

A DAM G REENE

Adam Greene is an engineer for a large financial news company based in New York City. Previously, he served as an engineer for iDefense, an intelligence company located in Reston, VA. His interests in computer security lie mainly in reliable exploitation methods, fuzzing, and UNIX-based system auditing and exploit development.

 

P EDRAM A MINI

Pedram Amini currently leads the security research and product security assessment team at TippingPoint. Previously, he was the assistant director and one of the founding members of iDefense Labs. Despite the fancy titles, he spends much of his time in the shoes of a reverse engineer–developing automation tools, plug-ins, and scripts. His most recent projects (a.k.a. “babies”) include the PaiMei reverse engineering framework and the Sulley fuzzing framework.

In conjunction with his passion, Pedram launched OpenRCE.org, a community website dedicated to the art and science of reverse engineering. He has presented at RECon, BlackHat, DefCon, ShmooCon, and ToorCon and taught numerous sold out reverse engineering courses. Pedram holds a computer science degree from Tulane University.

 

Customer Reviews

4.2 out of 5 stars
5 star
25%
4 star
75%
3 star
0%
2 star
0%
1 star
0%
See all 4 customer reviews
Share your thoughts with other customers

Most Helpful Customer Reviews

18 of 19 people found the following review helpful By Chris Gates on July 29, 2007
Format: Paperback
I anxiously awaited reading and putting this book to use. Fuzzing is one of those "mystical" concepts that the people cranking out exploits were doing and I wanted to be able to use some of the publicly available fuzzers to fuzz for vulnerabilities and join the ranks.

From the back cover: "...Now, its your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does."

I thought the book excellently covered the theory portions of fuzzing. The format of theory/background of a fuzzing method (Environment Variable and Argument Fuzzing, Web Application and Server fuzzing, File Format Fuzzing, Network Protocol Fuzzing, Web Browser Fuzzing, and In-Memory Fuzzing) followed with that fuzzing method Automation or on Unix and then on Windows worked perfectly. It was a good structure and informative. The Automation or Unix and Windows sections fit in well with the theory sections before it.

I think the book falls a bit short on practical execution (case studies) of using the fuzzing tools. Granted I say this based on my own expectations of what I would like to see from a fuzzing book but also from what the authors say in the preface that we will get out of the book. They say, "We detail numerous vulnerabilities throughout the book and discuss how they might have been identifies through fuzzing." Some of the case studies are exactly what I expected like case studies in Chapter 10, the fuzzing with SPIKE section in Chapter 15, and the Complete Walkthru with Sulley in Chapter 21. Some of the others fall a bit short.
Read more ›
1 Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
5 of 5 people found the following review helpful By Kristy M. Westphal on February 18, 2008
Format: Paperback
Perhaps a more appropriate title would be: "Fuzzing for Dummies" or "Fuzzing 101"- but I mean this in a really good way. Why I say this is because of how the book is set up, starting with the background history of fuzzing, and many variations of what fuzzing really is. These are excellent so those who may not have this background don't jump in blindly to this area. For example, Chapter 3 goes into the Fuzzing Methods and Chapter 4 discusses Data Representation. While not lengthy discussions, they are good to set up for the actual doing part in the rest of the book

I liked that the book starts out with what fuzzing is good for, the steps that you have to take for it to be successful, and what fuzzing is not good at. It explains how vectors like access control issues, and design flaws fit into this category. Knowing this up front saves a lot of head banging later on down the road. It's also good that the authors point out that they are merely defining fuzzing in their specific realm: talk to others and you are going to find a whole different explanation. This is OK though- most of the security industry is like that.

Part II of the book starts to get into the heart of things, discussing the components required for fuzzing, more details into the tool they built called "WebFuzz" and then dive into the tests themselves. The author's openness in telling us what they did, then how it works, then tell you all the things to make it better makes this book even more valuable. Good efforts to share useful things and make them a community effort with proper guidance are never a bad thing. Plus, if you are interested in helping, this guidance gives you somewhere to start.
Read more ›
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
3 of 4 people found the following review helpful By PorcusFortunae on December 11, 2008
Format: Paperback Verified Purchase
I loved the layout of the book, with explanations, practical applications, and (mostly) working examples. There were two things I didn't like about the book. First, not all the examples worked. Specifically, the Protocol Informatics (PI) example will not run on any machine I have. When I searched for a solution, it led me to the second thing I don't like about the book: it appears the authors cribbed their section on PI from PI's own documentation. It's clear they didn't even try to run it on their own. It makes me question whether they really understand it; if not, why are they writing about it in their book? I also wonder what else they cribbed. I also wish they'd update the book's website more, as much as they refer to it in the text.

All that aside, I really did enjoy and appreciate the book as a whole, and it certainly gave me a great foundational knowledge of fuzzing.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again
6 of 14 people found the following review helpful By Justine Aitel on August 29, 2007
Format: Paperback
In this book the authors do a number of things that are worth reading:
o Document how and why SPIKE works (and implement their own block-based fuzzer sulley)
o Go through the process of writing a .flv fuzzer
o Go through the process of writing a Python ActiveX fuzzer, which was probably my favorite part.
o Talk about the downsides of various kinds of fuzzing. For example, when is fuzzing with a genetic algorithm not the right thing to do?

That alone made this a great book.
Comment Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again

More About the Author

Discover books, learn about writers, read author blogs, and more.

Set up an Amazon Giveaway

Amazon Giveaway allows you to run promotional giveaways in order to create buzz, reward your audience, and attract new followers and customers. Learn more
Fuzzing: Brute Force Vulnerability Discovery
This item: Fuzzing: Brute Force Vulnerability Discovery
Price: $40.62
Ships from and sold by Amazon.com