In this video. I'm going to discuss the
basics of fuzzing. So before we go
to the Practical part before we go
to the exercises, we need to cover the basics and
this is exactly what I'm going to do in this
video. So let's do it.
Fuzzing is a semi-automated vulnerability
detection technique.
Let me now tell you something more about this semi-automated
nature of fuzzing.
Fuzzing is actually composed of two different things
automated attack first and then
manual verification.
In automated attack. We are going to use
the so-called father and the father is
going to do an automated attack for
us. And once this attack is
finished. Then we people we
need to come and do manual verification because
we need to assess whether a given
vulnerability is a true positive or false
positive. So you see right now that indeed
it is a semi-automated vulnerability detection
technique.
Now, let me tell you something more.
We need a tool for this automated attack.
We need a father. Right and
burp Suite Intruder is the most popular
father for web applications. And
in this course in one of the upcoming videos, I'm
going to tell you more about this tool. I'm going to
dive into this tool and all videos in
this course will be related to
this tool. So how to use this tool to do this kind
of automation.
Then once the automated attack is
done. We need to manually verify whether
a given vulnerability is a
true positive or a false positive.
But the question is how to do it. Probably we're gonna have a lot
of different results as a result of an automated
attack. Right and the idea
here is that we need to find anomalies in
the responses.
When we talk about web applications, we gonna
have requests and responses and
we need to analyze the responses and
we need to find anomalies in
this responses because anomalies May indicate
that there are vulnerabilities, okay.
And now the question is well, what kind of anomalous to
look for? Well different kinds
of anomalies for example length of response time
of response. Whatever whatever is
an anomaly whatever is different than
the vast majority of other results.
So try to find something that doesn't match to
the pattern something like this. I will
go into the details of this part in this course,
you will see how it works in practice. But now I just
want you to have an understanding of how it works how
to think in terms of fuzzing. Okay.
So these are the basics
And then when you do this manual verification then
your goal is to answer the question
whether a vulnerability is a
true positive or a false
positive, right? You just want to figure out
if this is indeed a vulnerability or
no. It is not a vulnerability. This is your goal. And
this is actually the final step of this
process. Right? So this is how it
works basically because now we are talking
about the basics and in the upcoming videos,
we will dive into
bird tweetingtruder you will
see how to use it how to configure it and
we will go into the details of every single
part and there will be demos, of course so that
you can practice all this steps. And
and yeah, this is it because I
want you to be able to apply this knowledge in your
own pen testing in your own bike hunting so we have
to
Word demos and practical examples. Okay.
This is it and in this module, so
let me right now jump to the next module and let
me discuss burp Suite intruder.