"The Codenomicon tools are amazing. Using them is like being attacked by the most relentless adversary who uses every possible method to find flaws in your code

We fixed subtle crash bugs in Samba that had been in the code for over ten years. We would never have found those bugs without the Codenomicon tools.

If you're serious about implementing protocols correctly, you need the Codenomicon tools."

-- Jeremy Allison,
   Co Creator of Samba


"Codenomicon has found a critical focus area which expands beyond web testing, where the XML industry has an opportunity to proactively assess the security holes contained in everyday services used by the general public. I would hope the industry warmly welcomes both the research results and an innovative testing solution to help diagnose the problems."

Prof. Howard A. Schmidt
former White House Cyber Security advisor & Codenomicon board member

DEFENSICS™ Traffic Capture Fuzzer   pdf

Introduction | Features | Benefits | Screenshots
Augment with Model Based Fuzzing | Test Solution

Features

Traffic Capture Fuzzing takes a real-life capture of a network traffic and fuzzes that to find security problems from communication software. The traffic captures can be created with network analyzers, loaded from Internet repositories, or taken from commercial vulnerability feeds. All tests from model-based fuzzers such as DEFENSICS test suites can also be extracted to PCAP files. Traffic Capture Fuzzing has some valuable features compared to other types of fuzzers:


» MORE PROTOCOLS: Traffic Capture Fuzzing differs from Model-Based Fuzzing in that it does not require protocol specifications to analyze protocols. Instead it utilizes network traffic captures to generate Fuzzers for security and robustness testing. The DEFENSICS testing platform utilizes packet analyzers to detect and capture network traffic. The use of packet analyzers the analysis of unspecified and even unknown protocols, e.g., WIRESHARK identifies over 750 protocols and also recognizes other protocol traffic.

» REAL NETWORK TRAFFIC: Network traffic consists of a packet or a stream of packets. Each packet contains a headers formed by known transport layer protocols, which ensure the delivery of the payload, coded in the protocol of interest. By analyzing the traffic of lower level protocols, we can make observations about the higher level protocol they are transporting, more specifically, about the protocol's message structures.

» EASY TO CREATE AND EXECUTE: The collected data is used by the DEFENSICS Testing Platform to create a test model and to mutate actual messages into anomalous feeds. DEFENSICS creates and executes the test cases; all the user needs to do is edit the messages if they contain System Under Test (SUT) specific information.

» INTEGRATION: The Traffic Capture Fuzzing model can be further developed by integrating expert knowledge, e.g., when developing Traffic Capture based tests for proprietary protocols, the protocol owners' knowledge of their own protocol provides valuable insight, which can be used to fine tune the models.