Automated fuzzing

Fuzzing is the smash and grab of the hacking community. It focuses around sending a large amount of invalid content to a page and recording the results. It is the reprobates version of SQL Injection and arguably the base form of penetration testing (though you LOIC users out there are probably the base form of life form).

We will create a script that will take values from the FuzzDB meta-characters file and send them to every parameter available and record all the results. This is most definitely a brute-force attempt to identify vulnerabilities and requires a sensible human being to go through the results.

Getting ready

For this, you will require the FuzzDB from Mozilla. At the time of printing, this is available from https://code.google.com/p/fuzzdb/. The file you specifically want for this script is /fuzzdb-1.09/attack-payloads/all-attacks/interesting-metacharacters.txt within the fuzzdb TAR file. I'm reusing the test PHP scripts from the XSS script for proof of concept...