queen-of-code / DotnetModelFuzzing

Model-based fuzzing for dotnet core, based on FuzzDB attacks. Especially good for fuzzing HTTP-based services!

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Introduction

Options for fuzz testing on dotnet core are somewhat limited - especially when you want to provide a data model that is not necessarily file or I/O based. Thus, enter Dotnet Model Fuzzing! Based on the attacks from FuzzDB, this package allows you to provide a model of your choice, generate an attack strategy based on that model, and then quickly apply fuzz attacks to that provided data model.

This allows you to provide sane templates for your data, such that your fuzz attacks will have a much higher likelyhood of testing code you actually care about. When you're running an HTTP service, testing IIS or Apache isn't all that useful compared to the benefit you would gain from testing your application-specific code!

Getting Started

TODO: Use the soon-to-be-published nuget package!

For examples on how to get started, take a look at the simple HTTP request application in ExampleApp.

Slides are available at https://www.slideshare.net/MelissaBenua/service-fuzz-testing-for-fun-and-profit

Contribute

All contributions welcome.

Further Reading

About

Model-based fuzzing for dotnet core, based on FuzzDB attacks. Especially good for fuzzing HTTP-based services!

License:MIT License


Languages

Language:HTML 62.3%Language:PHP 15.3%Language:C# 7.7%Language:Classic ASP 4.8%Language:Java 3.6%Language:Perl 2.6%Language:Shell 1.6%Language:ColdFusion 1.1%Language:ASP.NET 0.7%Language:C 0.2%Language:PowerShell 0.1%