This document describes how to use Defensics for fuzz testing and some general guidelines for safe testing. In this document, Defensics is used when referring to Defensics user interface.
Welcome to Black Duck® Defensics®. Defensics is a state-of-the-art fuzz testing software program.
Defensics test platform and Defensics test suites are used for negative testing, that is, to test the robustness of protocol implementations against malicious attacks and error situations. Defensics test suites send incorrectly formatted messages and message sequences in order to test the quality of a target protocol implementation or SUT (System Under Test).
Defensics test suites are named according to the protocol (for example, HTTP) and the protocol entity that they test (for example, Server or Client), for example Defensics HTTP Server Test Suite can be used to test a HTTP server implementation. Another test suite, Defensics HTTP Client Test Suite can be used to test HTTP clients.
Defensics is a controlling application that is installed separately from the individual Defensics test suites. Defensics can be used to install, operate and view the results of multiple different Defensics test suites. Test suites can be configured and operated concurrently.
How to Use This Guide
This guide contains all you need to install Defensics and to set up and configure your first project for fuzz testing. Installing Defensics details the steps you need to perform to install and configure your Defensics instance. Creating a Project describes how to create your initial project, how to select a test suite and how to configure the project for your first test run. Interoperability explains how you test the connectivity between Defensics and your target. Results shows you how to view the results, how to interpret them and how to use them to improve your test runs. Test Cases gives you an overview of test cases, how to select test cases manually and what restrictions can be placed on test runs. Instrumentation describes how to monitor the behavior of the system under testing during the test run and get insights about the occurring failures.
Fuzzing
Fuzzing is designed to break things and discover vulnerabilities during testing. You should keep the following principles in mind when fuzz testing:
- Don't fuzz production targets - fuzzing is destructive, fuzz only laboratory test instances
- Don't fuzz targets that will be in production - fuzzing can leave targets in unusual internal states
- Get physically close to your test target - any device between Defensics and the test target can interfere with fuzz testing
- Get logically close to your test target - disable firewalls or security countermeasures
- Perform attack surface analysis - list possible attack vectors in the protocol
Getting Help
Defensics is supported by a global team of security engineers. Ask for help in any of the following situations:
- You need help installing Defensics or installing a license server.
- You are having trouble with interoperability.
- You've located a bug in Defensics or a test suite.
- You want to request an enhancement to Defensics or a test suite.
- Login is required.
- You can join the Community whether you acquire your software from Arena or Community.
- You can join the Community by using the following registration form: https://community.blackduck.com/s/SelfRegistrationForm
- You don’t need a license ID to register, the field can be left empty. The user registration requests are reviewed and enabled by the Defensics team.
You can post questions to Community here: https://community.blackduck.com/s/discussions
You can post ideas to enhance the product here: https://community.blackduck.com/s/ideas-portal
Another way to contact Defensics support is by sending an email to tech-support@blackduck.com.
For the quickest and best response, provide the following information with your question:
- Test results as needed
- Packet captures as needed
- Configuration files
-
Anything else that might help
Defensics helps you package information for support. Use one of the following choices from the Defensics menu:
-
Help > Report Defensics issue > Support package from existing results
-
Help > Report Defensics issue > Support package by running a debug run