liveBook · Manning

Fuzzing

As explained in Hacking Cryptography

Fuzzing tests software by automatically generating or mutating inputs, often including malformed inputs, to expose failures and vulnerabilities.

Fuzzing automatically generates or mutates inputs, including malformed inputs, to expose software failures and vulnerabilities. For cryptographic code, it is especially important when parsing untrusted data in memory-unsafe languages. section 10.6 section 10.3

Use fuzzing alongside maximal test coverage rather than as a substitute for defensive implementation. It is intended to find parsing errors, memory-safety problems, integer overflows, and related failures before attackers do. section 10.6 section 10.9

Heartbleed

Fuzzing contributed to the independent discovery of Heartbleed. A malicious heartbeat could claim a very long payload while supplying little data, causing a vulnerable server to read beyond its buffer and disclose neighboring memory. section 10.6

Apply fuzzing where input handling can fail:

  • Exercise parsers extensively, especially when decryption requires validating user-supplied padding. section 10.3
  • Combine fuzzing with strict validation and constant-time implementation; testing cannot repair an unsafe parser by itself. section 10.9 section 10.3

How Hacking Cryptography covers it

How deep it goes
Connects fuzzing to coverage and parser safety but does not specify a fuzzing algorithm, harness, or operational workflow.
Examples
Uses Heartbleed and malformed heartbeat requests to demonstrate out-of-bounds reads and memory disclosure.
What you can do after
Diagnose memory-safety and parsing defects by combining extensive fuzzing with maximal test coverage.
How it connects
Ties fuzzing to memory safety, buffer management, parsing errors, padding validation, and constant-time implementation.
Cover of Hacking Cryptography
liveBookmanning.com
Read Hacking Cryptography on liveBook Get the book at manning.com

Also explained in

Compare how 7 books explain fuzzing →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Hacking Cryptography. The section links point to the parts of the book it draws on.