Fuzzing Methodology

Define the parser, endpoint, parameter, or state transition you are testing. A useful campaign has a measurable oracle: status, length, semantic field, crash, sanitizer finding, new coverage, or response-time boundary.

• One documented input surface and expected protocol state.
• A reproducible baseline seed or request.
• A clear signal for interesting behavior.
• A rate and resource budget.
• A place to store and minimize findings without sensitive production data.

1. 01

   Send the unchanged baseline several times and measure natural variation.

2. 02

   Test a guaranteed-missing value to identify wildcard or soft-404 behavior.

3. 03

   Filter by stable properties such as status, word count, line count, or response signature.

4. 04

   Start with low concurrency and increase only inside the agreed budget.

5. 05

   Manually inspect outliers before widening the wordlist.

ffuf -u https://lab.example/FUZZ \
  -w ./approved-small.txt \
  -rate 10 -t 2 -ac -of json -o findings.json

wfuzz -c -w ./approved-small.txt \
  --hc 404 --hh 0 \
  https://lab.example/FUZZ

Use context-specific dictionaries. Small lists built from routes, documentation, JavaScript, schemas, and business vocabulary usually outperform huge generic lists.

feroxbuster -u https://lab.example \
  -w ./approved-small.txt -t 2 --rate-limit 10 \
  --json --output ferox.json

For local software you own or a supplied lab binary, instrument the narrowest parser entry point. Keep setup outside the loop, seed with minimal valid samples, and use sanitizers to turn silent memory errors into actionable findings.

afl-clang-fast -fsanitize=address -o parser_harness parser_harness.c
mkdir -p seeds findings
printf "VALID" > seeds/minimal
afl-fuzz -i seeds -o findings -- ./parser_harness @@

• Minimize the starting corpus.
• Add grammar tokens or a dictionary for magic values.
• Separate hangs from crashes.
• Reproduce with the same build and sanitizer settings.
• Minimize the crashing input before triage.

Authenticated and multi-step protocols need valid prefix messages, refreshed identifiers, and explicit state tracking. Mutate the transition-driving message instead of corrupting the whole transcript.

1. 01

   Preserve setup and authenticated state in an isolated test account.

2. 02

   Replay the candidate at low rate.

3. 03

   Change one mutation at a time.

4. 04

   Compare against multiple clean baselines.

5. 05

   Store only the minimized input and sanitized response needed to reproduce.