What are characteristics of fuzz technique? What are uses of fuzz technique?

Fuzz testing or fuzzing as it is commonly known as, is another type of very popular mixed software testing methodology i.e., it can be either implemented as a black box testing technique or white box testing technique or even as grey box testing technique, though the latter case being very rare. 

- It also provides the options for running it manually or by some semi automated or fully automated processes. 

- Unexpected, invalid or random data is what all is fed as input data values to the test cases created for the fuzz testing of a software system or application. 

- After the arrangement of the test input data values for the test cases, the whole software system or application is subjected to an inspection to determine if at all it is experiencing any problems like crashes, memory leaks or failure of the code assertions that are nothing but built in defects in the software system or application. 

- Fuzz testing or fuzzing is actually a testing methodology that is categorized under the category of the security testing and is often used for security checks of a software system or application. 

Fuzz testing if further divided results in to two sub categories as described below:

1. Generation based fuzz testing: 

This type involves creation of entirely new set of input data based on the model input data and

2. Mutation based fuzz testing: 

This type is concerned with the generation of new set of data by mutating the existing samples.

Fuzz testing lays more emphasis more on the network protocols and the file formats of the software system or application than the other aspects of the system. But this does not hold necessary that only the network protocols and file formats should undergo fuzz testing, other aspects of the input data for the system can also be subjected to the fuzz testing. Common input for the fuzz testing basically includes:

1. Key board events
2. Mouse events
3. Environment variables and
4. API calls sequence.

The unusual input forms are:

Such as those being mentioned below can also be subjected to fuzz testing:

1. Shared memory
2. Contents of the data base of the software system or application and
3. Inter leaving of threads (precise)

The input data which manages to cross the trust boundary of the software system or application catches the attention of the testers more than any other happening during the testing. The origination of the fuzz testing is traced back to the University of Wisconsin and discovered by the professor Barton Miller. 

Uses of Fuzz Testing

The fuzz testing has emerged as a software testing technique with more than one uses:

1. For the testing of large projects having a budget just enough for the development of the test tools it can be employed as black box testing technique.
2. It is a very feasible and affordable software testing technique and has a high benefit- to - cost ratio.
3. The fuzz testing proves helpful in providing a sample stating the behavior of the software system or application generated in a random manner.
4. It very effectively demonstrates the exception handling capability of a piece of the source code of the program without crashing.
5. Fuzz testing gives an assurance for the maintenance of the overall quality of the software system or application rather than just acting as a testing tool for finding bugs.
6. Fuzz testing can also be used as a substitute for the formal methods employed for exhaustive testing of the software system.
7. One can rely on fuzz testing for determining the reliability of the software system as an application of static analysis, code audits or partial rewrites.

Explain the concepts of fuzz test technique?

WHAT IS FUZZ TESTING?

- Fuzz testing is the formal name for fuzzing which as we know is another software testing technique that involves playing with the software system or application using all types of possible invalid input test data.

- By the invalid input test data we mean it can be either unexpected data or random data i.e., any other type of test data other than the specified input data type.

- It is not necessary that the fuzz testing should always be automated; it can also be semi automatic though keeping the whole process fully automated consumes less time and effort.

- Semi automatic process is used only when there is manual interference required in the testing.

- After feeding the invalid input data to the software system or application, the behavior of the system is monitored for any exceptions like hanging, crashing or failing of the code assertions that are built in and also check for any memory leaks.

From the above discussions we can easily make out that the fuzz testing has been developed for testing of the security related issues of the software system or application. Till now two types of fuzz testing have been identified namely:

1. Mutation based testing
2. Generation based testing

CONCEPTS OF FUZZ TESTING

- Fuzz testing was developed to complement the negative testing and syntax testing.

- Both of the above types of the fuzz testing can be either employed as white box testing technique or black box testing technique or as a mix of the two techniques i.e., grey box testing.

- Whatever technique may be used, it is focussed up on the common target i.e., network protocols, file formats and so on.

- Though these two are the usually targeted elements, almost any type of input test data for the program can be subjected to the fuzz testing.

- The most common types of input data include:
1. Sequence of API calls
2. Environment variables
3. Mouse events
4. Keyboard events etc.

- Apart from just testing the input test data types, even some elements like shared memory, contents of a data base, interleaving of threads etc can also be tested by the fuzz test.

- But, usually the input that is able to cross the trust boundary of the security of the software system or application is targeted.

- Among all other approaches to fuzz testing, the one which is mostly preferred is the black box approach.

- This approach is mostly employed for the testing of large software projects having a budget for the development of the testing tools.

- Fuzz testing is included in the class of the software testing techniques that offer a high benefit – to – cost ratio.

- Like other software testing techniques, fuzz testing also has a drawback which is that it is able to develop only a sample of the behavior of the software system.

- In some rare cases, if the software passes the fuzz test, it merely indicates that only a part of the software system can effectively handle the unexpected input data types without any problem.

- This tells us that fuzz testing can be considered as an overall quality assurance factor and not merely just a bug finding tool.

- Fuzz testing is also not to be taken as a substitute neither for the formal methods nor for the exhaustive testing.

- It also gives us a gross measurement of the reliability of the software.

- Based on the results of the fuzz testing, it can be decided that which part needs a partial rewrite, static analysis or code audits.

What is meant by fuzz testing?

ABOUT FUZZ TESTING
- Fuzz testing or fuzzing as it is commonly known as, is another type of software testing methodology.
- It can be either operated manually or can be semi automated or fully automated.
- Unexpected, invalid or random data form the input data values for the fuzz testing of a software system or application.
- After arranging for the test input data values, the whole software system or application is then inspected if it is experience any problems like crashes, memory leaks or failure of the code assertions that are built in the software system or application.
- Fuzz testing or fuzzing is actually a testing methodology that falls under the category of the security testing and is often used for security checks of a software system or application.
- Fuzz testing emphasizes more on the network protocols and the file formats of the software system or application than the other aspects of the system.
- But it is not necessary that only the network protocols and file formats can undergo fuzz testing, other input aspects of the system can also be subjected to the fuzz testing.

CATEGORIES OF FUZZ TESTING
Fuzz testing if further divided in to two sub categories:

1. Generation based fuzz testing:
It involves creation of entirely new set of input data based on the model input data.

2. Mutation based fuzz testing:
It involves the mutation of the existing samples of the data to generate a new set of input data.

Both of the above mentioned approaches of the fuzz testing can be implemented using the white box testing, black box testing or grey box testing depending on the requirements of the testing.

INPUT FOR FUZZ TESTING
1. Common input for the fuzz testing basically includes:
- Key board events
- Mouse events
- Environment variables and
- API calls sequence.

2. Unusual types of inputs such as those being mentioned below can also be subjected to fuzz testing:
- Shared memory
- Contents of the data base of the software system or application and
- Inter leaving of threads (precise)

The input data which manages to cross the trust boundary of the software system or application catches the attention of the testers more than any other happening during the testing.

The origination of the fuzz testing is traced back to the University of Wisconsin and discovered by the professor Barton Miller.

USES OF FUZZ TESTING
The fuzz testing has emerged as a software testing technique with more than one uses:
1. For the testing of large projects having a budget just enough for the development of the test tools it can be employed as black box testing technique.
2. It is a very feasible and affordable software testing technique and has a high benefit- to - cost ratio.
3. The fuzz testing proves helpful in providing a sample stating the behavior of the software system or application generated in a random manner.
4. It very effectively demonstrates the exception handling capability of a piece of the source code of the program without crashing.
5. Fuzz testing gives an assurance for the maintenance of the overall quality of the software system or application rather than just acting as a testing tool for finding bugs.
6. Fuzz testing can also be used as a substitute for the formal methods employed for exhaustive testing of the software system.
7. One can rely on fuzz testing for determining the reliability of the software system as an application of static analysis, code audits or partial rewrites.
8. Fuzz testing as it involves generation of the invalid input data, is employed for checking out the error handling routines.
9. Fuzz testing is used as an approach for the automation of the negative testing.