A Stateful NetwOrk prOtocol fuzZEr
Fuzzing is a well-known black-box approach to the security testing of applications. Fuzzing has many advantages in terms of simplicity and effectiveness over more complex, expensive testing approaches. Unfortunately, current fuzzing tools suffer from a number of limitations, and, in particular, they provide little support for the fuzzing of stateful protocols.
We built a prototype of a fuzzing tool, called SNOOZE, in which we tried to integrate the strengths of existing fuzzing tools, while correcting the limitations mentioned above. SNOOZE is a tool for building flexible, security-oriented, network protocol fuzzers. SNOOZE implements a stateful fuzzing approach that can be used to effectively identify security flaws in network protocol implementations. SNOOZE allows a tester to describe the stateful operation of a protocol and the messages that need to be generated in each state. In addition, SNOOZE provides attack-specific fuzzing primitives that allow a tester to focus on specific vulnerability classes.
We used an initial prototype of the SNOOZE tool to test programs that implement the Session Initiation Protocol (SIP), an application-layer signaling protocol used to create, modify and terminate sessions with one or more participants, such as those found in Internet conferences and Internet telephone calls. SNOOZE allowed for the creation of sophisticated fuzzing scenarios that were able to expose real-world bugs in the programs analyzed.
2006 (1 publication)
SNOOZE: toward a Stateful NetwOrk prOtocol fuzZEr Proceedings of the Information Security Conference (ISC 2006)