What’s Fuzz Testing?

[ad_1]

Fuzz testing, or fuzzing, is a method of testing to see how a computer program or system will respond to various, sometimes random, inputs and information. The process involves generating some type of data, either completely random or random within certain constraints, and then feeding that data into the program to test how it handles unexpected information. The most basic form of fuzz testing involves sending a random sequence of keystrokes or characters to the program and checking that it processes them correctly. A more complex version of the fuzz test uses structured data which is then randomly manipulated and sent to the program. The data can reach the program as system events, keyboard inputs, fake network signals or even as files to be loaded.

There are various parts of a computer program that can be tested with a fuzz generator. The graphical user interface (GUI) can be tested by creating a sequence of random mouse and keyboard events and verifying that the GUI can handle input without crashing, freezing, or performing an unexpected activity. Network protocols can be tested by allowing the fuzz generator to randomly change parts of a valid data packet and then ensuring that the protocol can continue to operate after receiving bad data. You can test the ability of almost any program’s basic input elements to resist errors, such as an input that is too long for the type of storage, input of a different type than expected, and input that is somehow incomplete or wrong.

The computer security industry may use fuzz testing to ensure that there are no obvious security flaws in particular systems. This can be done using a fuzz generator designed to test computer security. These programs will try to use system keywords, known default administrator passwords, functions within the libraries used by the program, and random calls to system functions to see how the program will react.

The different types of fuzz tests can be customized to fall within certain ranges or even to test only specific types of input. This means that only valid commands could be sent to a program, but they could be in a nonsensical order. There are more complex fuzz test programs that can take elements of the target program and manipulate them to produce situations that could be maliciously exploited. This can include changing the order of spawned jobs, changing permissions, or changing master data and library files.

The end result of fuzz testing is to see if a program is safe and behaves as it should when faced with an unexpected situation. When used in conjunction with profiling and analysis software, it can also detect memory leaks in program areas such as error handling or performance bottlenecks. In case of computer security, dangerous problems like overflows that can compromise a system can be detected with proper configuration. Fuzz testing, however, cannot be used as the sole method of software testing and must be part of a larger software quality assurance and inspection process.

[ad_2]