Fuzzing
Fuzzing is an automated testing technique that supplies varied, malformed, unexpected, or mutated inputs to software to reveal failures, vulnerabilities, or other defects.
Secure APIs
Fuzzing is software testing that supplies varied, malformed, or unexpected inputs to discover faults and vulnerabilities.
- How it is used
- Validates API implementations against specifications and exposes failures caused by malformed or unexpected inputs.
- How deep it goes
- Demonstrates specification-driven execution, authentication setup, result interpretation, and a database failure, but stops short of remediation code.
- Examples
- Uses Schemathesis, OpenAPI specifications, live endpoints, malformed registration data, conformance reports, and a PostgreSQL NUL-byte error.
- What you can do after
- Diagnose API drift, conformance failures, ignored authentication, and input-handling defects with specification-driven tests.
AI for Everyday IT
Fuzz testing is a software-testing technique that supplies automatically generated, malformed, or unexpected inputs to find failures and vulnerabilities.
- How it is used
- Applies fuzz testing as a security check for AI-generated code, especially around authentication, data access, and user input.
- How deep it goes
- Defines the purpose and target areas but stops short of specifying fuzzing tools, input-generation methods, or execution procedures.
- Examples
- Targets AI-generated components handling authentication, data access, or user input.
- What you can do after
- Diagnose failures and vulnerabilities in security-sensitive code before accepting it as safe.
Hacking Cryptography
Fuzzing tests software by automatically generating or mutating inputs, often including malformed inputs, to expose failures and vulnerabilities.
- How it is used
- Finds memory-safety and parsing failures in cryptographic implementations, particularly those written in memory-unsafe languages.
- How deep it goes
- Connects fuzzing to coverage and parser safety but does not specify a fuzzing algorithm, harness, or operational workflow.
- Examples
- Uses Heartbleed and malformed heartbeat requests to demonstrate out-of-bounds reads and memory disclosure.
- What you can do after
- Diagnose memory-safety and parsing defects by combining extensive fuzzing with maximal test coverage.
Code Like a Pro in Rust
Fuzz testing is a software-testing technique that exercises programs with automatically generated or mutated inputs to reveal unexpected behavior, including failures caused by invalid data.
- How it is used
- Tests code against generated inputs, including invalid data, to find unexpected failures in exposed input-handling paths.
- How deep it goes
- Shows cargo-fuzz setup, a typed fuzz target, execution, and a failure; stops short of libFuzzer internals.
- Examples
- Uses a string-to-`i32` parser, an `Arbitrary` string input, and a cargo-fuzz failure artifact.
- What you can do after
- Apply it via cargo-fuzz to create and run a libFuzzer target against a Rust function.
Automating API Delivery
Fuzz testing is a technique that tests software by generating and submitting random, malformed, or semi-malformed inputs to expose defects.
- How it is used
- Exercises implemented APIs with generated unexpected inputs to expose undocumented behavior and validate API definitions.
- How deep it goes
- Explains a runnable Schemathesis workflow, generated data, recorded requests, and schema failures, but does not detail fuzzing algorithms.
- Examples
- Uses a Product Catalog API, an example UUID, cassette.yaml, unexpected response properties, and a 101-check test summary.
- What you can do after
- Diagnose/debug with it by locating schema mismatches, undocumented responses, unimplemented operations, and unexpected API behavior.
Go in Action, Second Edition
Fuzzing automatically tests software with generated or mutated inputs to find failures and unexpected behavior.
- How it is used
- Uses generated inputs to test edge cases and proactively search for breaking bugs in input-driven Go code.
- How deep it goes
- Explains corpus setup, fuzz callbacks, execution commands, failure minimization, and a Unicode bug fix.
- Examples
- Tests a string Contains function with words, empty strings, runes, generated inputs, and minimized Unicode failures.
- What you can do after
- Diagnose/debug with it by discovering, minimizing, reproducing, and fixing input-dependent failures.
Go in Practice, Second Edition
Fuzz testing is software testing that exercises a program with varied, automatically generated inputs to reveal unexpected behavior.
- How it is used
- Finds unexpected edge cases and potentially malicious-input failures by generating or modifying function inputs.
- How deep it goes
- Defines fuzzing and demonstrates Go seed cases plus a fuzz callback, but does not detail fuzzing internals.
- Examples
- Uses a rune-summing function, hand-written strings with Unicode and emojis, and a negative-result failure condition.
- What you can do after
- Apply it via Go's testing tools by seeding inputs and checking invariants for errors or unexpected formats.
Related concepts
- property-based testingcontrasts with · Property-based testing is a software-testing technique that generates varied inputs and checks whether specified general properties of the software’s behavior hold across them.
- testproduces · A test is a procedure or check that evaluates behavior using specified inputs or evidence against expected results or criteria.
- corpususes · A corpus is an organized collection of documents, texts, or other language data assembled for processing, retrieval, analysis, training, or evaluation.
- Schemathesisused by · Schemathesis is an open-source tool that generates and executes property-based tests for web APIs from API schemas such as OpenAPI definitions.
- libraryused by · A software library is a reusable collection of code or components that other programs can incorporate or invoke to provide functionality.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.