<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.5730.11" name=GENERATOR></HEAD>
<BODY
style="WORD-WRAP: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space">
<DIV dir=ltr align=left><SPAN class=983012815-27022007><FONT face=Arial
color=#0000ff size=2>In my personal experience with web app testing, I have
found that web fuzzers are not nearly as useful as fuzzers used for
applications, and more specifically I have found numerous bugs doing direct API
fuzzing. In the case of testing web applications I find that using something
like SpiDynamics tool is great for a first pass as a black box test, but to
really get an idea of how bad the vulnerability is, the extent, etc. manual
testing is an absolute must. I know that most people on this list don't
necessarily believe in fuzzing as a good security test, and I can hear Gary
groaning already, but I think that fuzzing tools are becoming more and more
intelligent, and you are soon going to see some extremely powerful tools in this
arena. Check out the paper on genetic algorithms and fuzzing from BlackHat as
well as the tool from Jared DeMott at Applied Security.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=983012815-27022007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=983012815-27022007><FONT face=Arial
color=#0000ff size=2>As for Metasploit, its a very sweet tool, as well as a very
useful framework for learning and developing exploits, particularly the tricky
IE+ActiveX heap nastiness that requires a little kung fu and a lot of coffee.
</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=983012815-27022007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=983012815-27022007><FONT face=Arial
color=#0000ff size=2>JS</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> sc-l-bounces@securecoding.org
[mailto:sc-l-bounces@securecoding.org] <B>On Behalf Of </B>Kenneth Van
Wyk<BR><B>Sent:</B> Tuesday, February 27, 2007 12:06 AM<BR><B>To:</B> Secure
Coding<BR><B>Subject:</B> [SC-L] Dark Reading - Desktop Security - Here Comes
the (Web) Fuzz- Security News Analysis<BR></FONT><BR></DIV>
<DIV></DIV><BASE href=data:>
<DIV
style="FONT-SIZE: 12px; COLOR: black; FONT-FAMILY: Helvetica; TEXT-ALIGN: left">Here's
an interesting article from Dark Reading about web fuzzers. Web fuzzing seems to
be gaining some traction these days as a popular means of testing web apps and
web services.</DIV>
<DIV
style="FONT-SIZE: 12px; COLOR: black; FONT-FAMILY: Helvetica; TEXT-ALIGN: left"><BR
class=khtml-block-placeholder></DIV><A
href="http://www.darkreading.com/document.asp?doc_id=118162&f_src=darkreading_section_296">http://www.darkreading.com/document.asp?doc_id=118162&f_src=darkreading_section_296</A>
<DIV
style="FONT-SIZE: 12px; COLOR: black; FONT-FAMILY: Helvetica; TEXT-ALIGN: left"><BR
class=khtml-block-placeholder></DIV>Any good/bad experiences and opinions to be
shared here on SC-L regarding fuzzing as a means of testing web apps/services? I
have to say I'm unconvinced, but agree that they should be one part--and a small
one at that--of a robust testing regimen.
<DIV><BR class=khtml-block-placeholder></DIV>
<DIV>Cheers,</DIV>
<DIV><BR class=khtml-block-placeholder></DIV>
<DIV>Ken</DIV>
<DIV><BR class=khtml-block-placeholder></DIV>
<DIV>P.S. I'm over in Belgium right now for SecAppDev (<A
href="http://www.secappdev.org">http://www.secappdev.org</A>). HD Moore wowed
the class here with a demo of Metasploit 3.0. For those of you that haven't
looked at this (soon to be released, but available in beta now) tool, you really
should check it out. Although it's geared at the IT Security pen testing
audience, I do believe that it has broader applicability as a framework for
constructing one-off exploits against applications.<BR>
<DIV><SPAN class=Apple-style-span
style="WORD-SPACING: 0px; FONT: 12px Helvetica; TEXT-TRANSFORM: none; COLOR: rgb(0,0,0); TEXT-INDENT: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; border-spacing: 0px 0px; -khtml-text-decorations-in-effect: none; -apple-text-size-adjust: auto; orphans: 2; widows: 2"><SPAN
class=Apple-style-span
style="WORD-SPACING: 0px; FONT: 12px Helvetica; TEXT-TRANSFORM: none; COLOR: rgb(0,0,0); TEXT-INDENT: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; border-spacing: 0px 0px; -khtml-text-decorations-in-effect: none; -apple-text-size-adjust: auto; orphans: 2; widows: 2"><SPAN
class=Apple-style-span
style="WORD-SPACING: 0px; FONT: 12px Helvetica; TEXT-TRANSFORM: none; COLOR: rgb(0,0,0); TEXT-INDENT: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; border-spacing: 0px 0px; -khtml-text-decorations-in-effect: none; -apple-text-size-adjust: auto; orphans: 2; widows: 2"><SPAN
class=Apple-style-span
style="WORD-SPACING: 0px; FONT: 12px Helvetica; TEXT-TRANSFORM: none; COLOR: rgb(0,0,0); TEXT-INDENT: 0px; WHITE-SPACE: normal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; border-spacing: 0px 0px; -khtml-text-decorations-in-effect: none; -apple-text-size-adjust: auto; orphans: 2; widows: 2">
<DIV>-----</DIV>
<DIV>Kenneth R. van Wyk</DIV>
<DIV>SC-L Moderator</DIV>
<DIV>KRvW Associates, LLC</DIV>
<DIV><A href="http://www.KRvW.com">http://www.KRvW.com</A></DIV>
<DIV><BR class=khtml-block-placeholder></DIV>
<DIV><BR class=khtml-block-placeholder></DIV><BR
class=Apple-interchange-newline></SPAN></SPAN></SPAN></SPAN></DIV><BR></DIV></BODY></HTML>