Fuzzing for exception handling vulnerabilities
In Chapter 4, you quickly experimented with fuzzing by taking part in the exercises that we conducted with Burp Suite. Now, we are going to dive deeper into this technique. Fuzzing is very important in the context of API pentesting since it can expose an application’s vulnerabilities and weaknesses when incorrectly handling unexpected input. The types of vulnerabilities that can be raised from such bad handling may vary from information disclosure to denial-of-service (DoS).
A popular approach to fuzzing for exception handling vulnerabilities involves utilizing automated tools such as American Fuzzy Lop (AFL). AFL, created by Michal Zalewski and nowadays maintained by Google, is very good at creating random patterns to provide as input when testing API endpoints or apps. It operates by repeatedly modifying input files and monitoring the target application for crashes or unusual behavior. There are some good fuzzers out there...
