Fuzzing on the HTTP protocol implementation in mobile embedded web server
Résumé
The fuzzing is a technique which allows to generate invalid, unexpected, or random data to supply them in the various inputs of the software or the protocol to be tested. That allows to find situations not expected by the programmers and sometimes to influence the functioning of the target. Our work aims to check implementations of the HTTP protocol in smart card embedded web servers. For that, we have used the fuzzing method to found vulnerabilities and compliance of this sort of web server. Moreover, working on black box forced us to use PyHAT to collect a maximum of information of the target features. Thus, we can reduce the amount of properties to analyze. Our fuzzing program is based on the Peach framework adapted to our needs. Then, with data model and state model of the target, Peach will generate the fuzzing data. We have also defined mutators to represent the mutations types used. Results generated by logs files are finally automatically analyzed to understand the behavior of the application and to detect if some fuzzed data succeed to take up vulnerabilities.
Domaines
Cryptographie et sécurité [cs.CR]Origine | Fichiers produits par l'(les) auteur(s) |
---|