Abstract:Network-facing applications are commonly exposed to all kinds of attacks, especially when connected to the internet. As a result, web servers like Nginx or client applications such as curl make every effort to secure and harden their code to rule out memory safety violations. One would expect this to include regular fuzz testing, as fuzzing has proven to be one of the most successful approaches to uncovering bugs in software. Yet, surprisingly little research has focused on fuzzing network applications. When studying the underlying reasons, we find that the interactive nature of communication, its statefulness, and the protection of exchanged messages render typical fuzzers ineffective. Attempts to replay recorded messages or modify them on the fly only work for specific targets and often lead to early termination of communication. In this paper, we discuss these challenges in detail, highlighting how the focus of existing work on protocol state space promises little relief. We propose a fundamentally different approach that relies on fault injection rather than modifying messages. Effectively, we force one of the communication peers into a weird state where its output no longer matches the expectations of the target peer, potentially uncovering bugs. Importantly, this weird peer can still properly encrypt/sign the protocol message, overcoming a fundamental challenge of current fuzzers. In effect, we leave the communication system intact but introduce small corruptions. Since we can turn either the server or the client into the weird peer, our approach is the first that can effectively test client-side network applications. Evaluating 16 targets, we show that Fuzztruction-Net outperforms other fuzzers in terms of coverage and bugs found. Overall, Fuzztruction-Net uncovered 23 new bugs in well-tested software, such as the web servers Nginx and Apache HTTPd and the OpenSSH client.

Battling against Protocol Fuzzing: Protecting Networked Embedded Devices from Dynamic Fuzzers

Constructing Cyber-Physical System Testing Suites Using Active Sensor Fuzzing

Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware

Active Fuzzing for Testing and Securing Cyber-Physical Systems

PAVFuzz: State-Sensitive Fuzz Testing of Protocols in Autonomous Vehicles

NAFuzzer: Augmenting Network Protocol Fuzzers Via Automatic Template and Seed Generation

Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware

NESTFUZZ: Enhancing Fuzzing with Comprehensive Understanding of Input Processing Logic

Vulnerability Detection Through an Adversarial Fuzzing Algorithm

No Peer, no Cry: Network Application Fuzzing via Fault Injection

EM-Fuzz: Augmented Firmware Fuzzing Via Memory Checking

Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences

EcoFuzz: Adaptive Energy-Saving Greybox Fuzzing As a Variant of the Adversarial Multi-Armed Bandit

A deep convolution generative adversarial networks based fuzzing framework for industry control protocols

Fuzz testing in practice: Obstacles and solutions

FuzzFabric: A Scalable Grey-box Fuzzing Framework for Polymorphic Network Services

EmbedFuzz: High Speed Fuzzing Through Transplantation

DY Fuzzing: Formal Dolev-Yao Models Meet Cryptographic Protocol Fuzz Testing

Model-Based Grey-Box Fuzzing of Network Protocols

FDFuzz: Applying Feature Detection to Fuzz Deep Learning Systems

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering