Service-Fingerprinting mittels Fuzzing
نویسندگان
چکیده
Für die Durchführung effektiver Penetrationstests ist die Identifizierung von Diensten (Services) und Applikationen auf den Zielsystemen, das sogenannte Service-Fingerprinting, von zentraler Bedeutung. Ziel dieses Beitrags ist es, mögliche Verbesserungspotentiale bestehender Fingerprinting-Tools zu beleuchten. Dies soll durch Einsatz von Mutation-Based Fuzzing zwecks einfacher und automatischer Erzeugung von Fingerprints erreicht werden. Durch Versenden der so präparierten Anfragen an bestimmte Dienste und Dienstversionen sollen subtile Unterschiede in den Antwortnachrichten erfasst werden, die Identifizierungsund Unterscheidungsmerkmale bilden.
منابع مشابه
Verbesserung von OS- und Service-Fingerprinting mittels Fuzzing
Inhaltsverzeichnis Abbildungsverzeichnis V Tabellenverzeichnis V Abkürzungsverzeichnis VI 1 Einleitung 1
متن کاملProtocol State Fuzzing of TLS Implementations
We describe a largely automated and systematic analysis of TLS implementations by what we call ‘protocol state fuzzing’: we use state machine learning to infer state machines from protocol implementations, using only blackbox testing, and then inspect the inferred state machines to look for spurious behaviour which might be an indication of flaws in the program logic. For detecting the presence...
متن کاملH-Fuzzing: A New Heuristic Method for Fuzzing Data Generation
How to efficiently reduce the fuzzing data scale while assuring high fuzzing veracity and vulnerability coverage is a pivotal issue in program fuzz test. This paper proposes a new heuristic method for fuzzing data generation named with H-Fuzzing. H-Fuzzing achieves a high program execution path coverage by retrieving the static information and dynamic property from the program. Our experiments ...
متن کاملThe future of grey-box fuzzing
Society are becoming more dependent on software, and more artifacts are being connected to the Internet each day[31]. This makes the work of tracking down vulnerabilities in software a moral obligation for software developers. Since manual testing is expensive[7], automated bug finding techniques are attractive within the quality assurance field, since it can save companies a lot of money. This...
متن کاملFuzzing: The State of the Art)
Fuzzing is an approach to software testing where the system being tested is bombarded with test cases generated by another program. The system is then monitored for any flaws exposed by the processing of this input. While the fundamental principles of fuzzing have not changed since the term was first coined, the complexity of the mechanisms used to drive the fuzzing process have undergone signi...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
- CoRR
دوره abs/1403.0766 شماره
صفحات -
تاریخ انتشار 2014