Fuzzing

Fuzzing is a testing technique. It involves trying a program on random inputs, which are ever so slightly altered - or fuzzed - between runs.

Fuzzing is particularly useful in testing the security of software that process untrusted input which needs to be parsed. From Godefroid 2020:

Since the early 2000s, fuzzing has become a mainstream practice in assessing software security. Thousands of security vulnerabilities have been found while fuzzing all kinds of software applications for processing documents, images, sounds, videos, network packets, Web pages, among others. These applications must deal with untrusted inputs encoded in complex data formats. For example, the Microsoft Windows operating system supports over 360 file formats and includes millions of lines of code just to handle all of these.

Fuzzers

References

There is a youTube video explaining fuzzing, which accompanies the following CACM intro article:

Godefroid, Patrice. 2020. ‘Fuzzing: Hack, Art, and Science’. Communications of the ACM 63 (2): 70–76. https://doi.org/10.1145/3363824. pdf

@article{godefroid_2020,
	title = {Fuzzing: hack, art, and science},
	volume = {63},
	doi = {10.1145/3363824},
	number = {2},
	journal = {Communications of the ACM},
	author = {Godefroid, Patrice},
	year = {2020},
	pages = {70--76},
}