Yini i-Fuzzing?
Isingeniso: Kuyini i-Fuzzing?
Ngo-2014, abaduni baseShayina igqekezwe kuma-Community Health Systems, isibhedlela sase-US esenza inzuzo, futhi yeba idatha yeziguli eziyizigidi ezingu-4.5. Abagebengu basebenzise isiphazamisi esibizwa ngokuthi yi-Heartbleed esatholwa kulabhulali ye-cryptography ye-OpenSSL ezinyangeni ezimbalwa ngaphambi kobugebengu.
I-Heartbleed isibonelo sekilasi lama-vectors okuhlasela avumela abahlaseli ukuthi bafinyelele okuqondisiwe ngokuthumela izicelo ezingalungile ezivumelekile ukuthi ziphumelele ukuhlolwa kokuqala. Nakuba ochwepheshe abasebenza ezingxenyeni ezihlukene zohlelo lokusebenza benza konke okusemandleni abo ukuze baqinisekise ukuvikeleka kwalo, akunakwenzeka ukucabanga ngazo zonke izimo ezikhona ezingase ziphule uhlelo lokusebenza noma zilwenze lube sengcupheni ngesikhathi sokuthuthukiswa.
Yilapho 'ukufutha' kungena khona.
Iyini i-Fuzzing Attack?
I-Fuzzing, ukuhlola kwe-fuzz, noma ukuhlasela okungaqondakali, kuyindlela yokuhlola isofthiwe ezenzakalelayo esetshenziselwa ukuphakela idatha engahleliwe, engalindelekile, noma engavumelekile(okuthiwa i-fuzz) kuhlelo. Uhlelo luqashelwa ukuziphatha okungajwayelekile noma okungalindelekile njengokuchichima kwebhafa, ukuphahlazeka, ukuvuza kwenkumbulo, ukulengiswa kwentambo, kanye nokwephulwa kokufinyelela kokufunda/ukubhala. Ithuluzi le-fuzzing noma i-fuzzer bese isetshenziselwa ukwembula imbangela yokuziphatha okungajwayelekile.
I-Fuzzing isuselwe ekucabangeni ukuthi wonke amasistimu aqukethe iziphazamisi ezilindele ukutholwa, futhi anganikezwa isikhathi esanele nezinsiza zokwenza lokho. Amasistimu amaningi anabahlaluli abahle kakhulu noma ukuvimbela ukuqinisekiswa kokufaka cybercrgebengu kusukela ekusebenziseni noma yiziphi iziphazamisi ezicatshangelwayo ohlelweni. Kodwa-ke, njengoba sishilo ngenhla, ukumboza wonke amacala ekhoneni ngesikhathi sokuthuthukiswa kunzima.
Ama-Fuzzer asetshenziswa ezinhlelweni ezithatha okokufaka okuhlelekile noma ezinohlobo oluthile lomngcele wokuthembela. Isibonelo, uhlelo olwamukela amafayela e-PDF lungaba nokuqinisekiswa okuthile ukuze kuqinisekiswe ukuthi ifayela linesandiso se-.pdf kanye nesihlungi ukuze kucutshungulwe ifayela le-PDF.
I-fuzzer esebenzayo ingakwazi ukukhiqiza okokufaka okuvumeleke ngokwanele ukuze kudlule le mingcele kodwa okungavumelekile ukuze kubangele ukuziphatha okungalindelekile kude nohlelo. Lokhu kubalulekile ngoba ukukwazi nje ukwedlula iziqinisekiso akusho okuningi uma kungekho omunye umonakalo obangwayo.
Ama-Fuzzers athola ama-vectors okuhlasela afana kakhulu futhi afaka ukuthandwa komjovo we-SQL, ukubhalwa kwe-cross-site, ukuchichima kwe-buffer, nokuhlasela kwe-denial-of-service. Konke lokhu kuhlasela kuwumphumela wokuphakela idatha engalindelekile, engavumelekile, noma engahleliwe ohlelweni.
Izinhlobo ze-Fuzzers
Ama-Fuzzers angahlukaniswa ngokusekelwe kwezinye izici:
- Ukuhlasela okuqondiwe
- Indlela yokudala i-Fuzz
- Ukuqwashisa ngesakhiwo sokufakwayo
- Ukuqwashisa ngesakhiwo sohlelo
1. Ukuhlasela Okuhlosiwe
Lokhu kuhlukaniswa kusekelwe ohlotsheni lwenkundla i-fuzzer esetshenziselwa ukuhlola. Ama-Fuzzers avame ukusetshenziswa nezivumelwano zenethiwekhi kanye nezinhlelo zesoftware. Inkundla ngayinye inohlobo oluthile lokokufaka ekutholayo, futhi ngaleyo ndlela idinga izinhlobo ezahlukene zamafuzzer.
Isibonelo, uma usebenzisana nezinhlelo zokusebenza, yonke imizamo engaqondakali ivela eziteshini zokufaka ezihlukahlukene zohlelo lokusebenza, njengesixhumi esibonakalayo somsebenzisi, itheminali yomugqa womyalo, amafomu/okufakwayo kombhalo, nokulayishwa kwefayela. Ngakho konke okokufaka okukhiqizwa i-fuzzer kufanele kufane nalezi ziteshi.
Ama-Fuzzers asebenzisana nezinqubo zokuxhumana kufanele abhekane namaphakethe. Ama-Fuzzers aqondise le nkundla angakwazi ukukhiqiza amaphakethe omgunyathi, noma asebenze njengama-proxi ukuze alungise amaphakethe abanjiwe futhi awadlale kabusha.
2. Indlela Yokudala I-Fuzz
Ama-Fuzzer nawo angahlukaniswa ngokuya ngokuthi adala kanjani idatha ezoxutshwa nawo. Ngokomlando, ama-fuzzer adala i-fuzz ngokukhiqiza idatha engahleliwe kusukela ekuqaleni. Lena yindlela uProfessor Barton Miller, umsunguli wale nqubo, akwenze ngayo ekuqaleni. Lolu hlobo lwe-fuzzer lubizwa ngokuthi a i-fuzzer esekwe esizukulwaneni.
Kodwa-ke, ngenkathi umuntu engakwazi ukukhiqiza idatha engeke yeqe umngcele wokuthembana, kuzothatha isikhathi esiningi nezinsiza ukwenza kanjalo. Ngakho-ke le ndlela ijwayele ukusetshenziselwa amasistimu anezakhiwo zokufaka ezilula.
Isixazululo sale nkinga ukuguqula idatha eyaziwa ukuthi ivumelekile ukuze kukhiqizwe idatha evumeleke ngokwanele ukuze kudlule umngcele wokuthembana, nokho okungavumelekile ukuthi kubangele izinkinga. Isibonelo esihle salokhu a I-DNS fuzzer okuthatha igama lesizinda bese kwakheka uhlu olukhulu lwamagama esizinda ukuze kutholwe izizinda ezingaba yingozi eziqondise kumnikazi wesizinda esishiwo.
Le ndlela ihlakaniphe kuneyangaphambili futhi inciphisa kakhulu izimvume ezingaba khona. Ama-Fuzzers asebenzisa le ndlela abizwa ngokuthi ama-fuzzers asekelwe ekuguquleni.
Kukhona indlela yesithathu yakamuva kakhulu esebenzisa ama-algorithms wofuzo ukuhlangana kudatha ye-fuzz edingekayo ukuze kukhishwe ubungozi. Isebenza ngokuqhubekayo icwenga idatha yayo ye-fuzz, icabangela ukusebenza kwedatha ngayinye yokuhlola lapho ifakwa ohlelweni.
Amasethi edatha asebenza kabi kakhulu akhishwa kudatha yedatha, kuyilapho angcono kakhulu aguqulwa futhi/noma ahlanganiswe. Isizukulwane esisha sedatha sibe sesisetshenziselwa ukuhlolwa kwe-fuzz futhi. Lawa ma-fuzzers abizwa ngokuthi amafuzzers asekelwe ekuziphendukeleni kwemvelo.
3. Ukuqwashisa Ngesakhiwo Sokufaka
Lesi sigaba sisekelwe ekutheni i-fuzzer iyazi futhi isebenzisa ngokusebenzayo isakhiwo sokufakwayo sohlelo ekukhiqizeni idatha ye-fuzz. A fuzzer oyisimungulu (i-fuzzer engazi ngesakhiwo sohlelo) ikhiqiza i-fuzz ngendlela engavamile kakhulu. Lokhu kungafaka kokubili amafuzzer asekelwe ekukhiqizeni nasekuguquleni.
Uma i-fuzzer ihlinzekwa ngemodeli yokufaka yohlelo, i-fuzzer ingase izame ukukhiqiza noma ukuguqula idatha ukuze ifane nemodeli yokufaka enikeziwe. Le ndlela iqhubeka inciphisa inani lezinsiza ezichithwa kukhiqizwa idatha engavumelekile. I-fuzzer enjalo ibizwa ngokuthi a i-smart fuzzer.
4. Ukuqwashisa Ngesakhiwo Sohlelo
Ama-Fuzzer nawo angahlukaniswa ngokuya ngokuthi ayakwazi yini ukusebenza kwangaphakathi kohlelo abaluxabanisayo, futhi basebenzise lokho kuqwashisa ukusiza ukukhiqiza idatha ye-fuzz. Uma ama-fuzzer esetshenziselwa ukuhlola uhlelo ngaphandle kokuqonda ukwakheka kwalo kwangaphakathi, kubizwa ngokuthi ukuhlola kwebhokisi elimnyama.
Idatha ye-Fuzz ekhiqizwa ngesikhathi sokuhlolwa kwebhokisi elimnyama ngokuvamile ayihleliwe ngaphandle kwalapho i-fuzzer iyi-fuzzer esekelwe ekuguquguqukeni, lapho 'ifunda' ngokuqapha umthelela wokufiphala kwayo nokusebenzisa lokho. Imininingwane ukuze wenze ngcono isethi yayo yedatha ye-fuzz.
Ukuhlola ibhokisi elimhlophe ngakolunye uhlangothi kusebenzisa imodeli yesakhiwo sangaphakathi sohlelo ukukhiqiza idatha ye-fuzz. Le ndlela ivumela i-fuzzer ukuthi ifinyelele ezindaweni ezibalulekile kuhlelo futhi iluhlole.
Amathuluzi e-Fuzzing adumile
Kukhona ama-fuzzing amaningi Amathuluzi laphaya esetshenziswa abahloli bepeni. Ezinye ezidume kakhulu yilezi:
Imikhawulo Of Fuzzing
Ngenkathi i-Fuzzing iyindlela ewusizo ngempela yokuhlola ipeni, ayinawo amaphutha ayo. Ezinye zazo yilezi:
- Kuthatha isikhathi eside impela ukugijima.
- Ukuphahlazeka nokunye ukuziphatha okungalindelekile okutholwe ngesikhathi sokuhlolwa kwebhokisi elimnyama lohlelo kungaba nzima, uma kungenzeki ukuthi kuhlaziywe noma kulungiswe.
- Ukudala izifanekiso zokuguqulwa kwezakhi zamafuzzer asekelwe kukuguqulwa okuhlakaniphile kungase kudle isikhathi. Kwesinye isikhathi, kungenzeka kungenzeki ngenxa yokuthi imodeli yokufaka ingubunikazi noma engaziwa.
Noma kunjalo, iyithuluzi elihle futhi elidingekayo kunoma ngubani ofuna ukuthola izimbungulu ngaphambi kwabantu ababi.
Isiphetho
I-Fuzzing iyindlela enamandla yokuhlola ipeni engasetshenziswa ukwembula ubungozi kusofthiwe. Kunezinhlobo eziningi ezahlukene zamafuzzer, futhi amafuzzer amasha athuthukiswa ngaso sonke isikhathi. Nakuba i-fuzzing iyithuluzi eliwusizo ngendlela emangalisayo, inemikhawulo yayo. Isibonelo, ama-fuzzer angathola kuphela ubungozi obuningi futhi angasebenzisa kakhulu izinsiza. Nokho, uma ufuna ukuzama le nqubo emangalisayo ngokwakho, sinawo a I-DNS Fuzzer API yamahhala ongayisebenzisa endaweni yethu yesikhulumi.
Ngakho-ke ulindeleni?
