2 cissp ® Official Study Guide Eighth Edition

Mutation (Dumb) Fuzzing
Takes previous input values from actual operation of the soft-
ware and manipulates (or mutates) it to create fuzzed input. It might alter the characters of 
the content, append strings to the end of the content, or perform other data manipulation 
techniques.
Generational (Intelligent) Fuzzing
Develops data models and creates new fuzzed input 
based on an understanding of the types of data used by the program.
The zzuf tool automates the process of mutation fuzzing by manipulating input 
according to user specifications. For example, Figure 15.10 shows a file containing a 
series of 1s.
Figure 15.11 shows the zzuf tool applied to that input. The resulting fuzzed text is 
almost identical to the original text. It still contains mostly 1s, but it now has several 
changes made to the text that might confuse a program expecting the original input. This 
process of slightly manipulating the input is known as 
bit flipping
.
Fuzz testing is an important tool, but it does have limitations. Fuzz testing typically 
doesn’t result in full coverage of the code and is commonly limited to detecting simple vul-
nerabilities that do not require complex manipulation of business logic. For this reason, 
fuzz testing should be considered only one tool in a suite of tests performed, and it is useful 
to conduct test coverage analysis (discussed later in this chapter) to determine the full scope 
of the test.

---

Testing Your Software 
685
F I G u r e 15 .10
Prefuzzing input file containing a series of 1s
F I G u r e 15 .11
The input file from Figure 15.10 after being run through the zzuf 
mutation fuzzing tool

---

686
Chapter 15 
■
Security Assessment and Testing