Defensics creates test cases for you, allowing you quickly get started searching for vulnerabilities.
This chapter describes how to use Defensics' test case selection tools and how to manage the amount of testing you want to do.
In Test Cases tab you can manage the test cases of the Test Suite.
Test Run Extent displays how you can limit the test run time, test cases, max instrumentations and max failed cases. This is useful when you are short on time.
Test Run Extent can be used to limit test run time and the number of executed test cases, which ever limit comes first.
By default, Defensics has generated a set of test cases that provides good coverage of the fields of the exchanged protocol messages. If there’s need to narrow testing to some specific field or value, it is possible to cherry pick groups of tests or individual test in test groups tree.
In Test Groups you can drill down from test groups to sub test groups and individual test cases.
In a test group you can select or deselect individual test cases.
The Tree View
You can use the tree view to navigate through the test cases field by field. This is useful for understanding how Defensics creates all the test material.
Defensics is a generational model-based fuzzer. The Defensics engine is programmed with knowledge on input type, whether it’s an interface, protocol, or file format. Because the engine has a deep understanding of the valid input and rules that govern communication, it can deliver targeted test cases. Even when Defensics is configured with sample input, such as a file or network traffic capture, it tries to reverse engineer the sample to a known model before generating test cases.
Defensics sometimes applies binary and text mutation anomalies, but its strength is in injecting anomalies systematically to different model-based locations of the input. Several anomaly types selected specifically for the protocol or file format being tested are applied. Some examples are, for example, integer, overflow and JSON anomalies.
In simplest terms, you can think of Defensics iterating through the model field by field, creating test cases as it goes. If you have the HTTP suite loaded, you can see how this works by navigating to a group of test cases that is just for the version field, which is the third field in the first line of an HTTP request.
Defensics groups test cases by the type of anomaly they contain. Start by expanding the http-request group. Then expand http-request-header and click on request-line. This test case group contains test cases that anomalize fields in the first line of the HTTP request, the request line.
Test Case Execution Mode
In Test Case Execution Mode you can control how Defensics executes test cases:
- Balanced Mode
- Random - a random selection of test cases is used.
- First-and-Last
- Sequential - test cases are performed in sequential order.