Fuzz testing and attack-surface scoping for URI handlers and pluggable protocols

• US 8,417,993 B2
• Filed: 06/21/2007
• Issued: 04/09/2013
• Est. Priority Date: 06/21/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: O'Leary, Arthur James
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): LAKHIA, VIRAL S
• Application Number:
  US11/766,582
• Publication Number:
  US 20080320328A1
• Time in Patent Office: 2,119 Days
• Field of Search: 714 24- 25
• US Class Current: 714/25
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

Systems and methods for testing uniform resource identifier protocols, comprising a fuzzer that can accept an input, and produce a fuzzed uniform resource identifier (URI), and a debugger that monitors effects of invoking the fuzzed uniform resource identifier. The input can comprise a directory containing a plurality of valid uniform resource identifier bodies, which can be fuzzed and invoked. The debugger can monitor a target application as well as other applications and/or processes affected by the uniform resource identifier as invoked.

Claims

1. A computer-implemented system comprising:

a processor configured to execute computer-executable instructions; and

memory storing computer-executable instructions for;

fuzzing, by a fuzzer, at least one valid uniform resource identifier body to generate a fuzzed uniform resource identifier body;

appending a uniform resource identifier header to the fuzzed uniform resource identifier body to create a fuzzed uniform resource identifier;

monitoring, by a debugger, a target application for effects of invocation of the fuzzed uniform resource identifier; and

automatically outputting, by the debugger to the fuzzer, suggested fuzzing for one or more subsequent valid uniform resource identifier bodies based, at least, on monitored effects of the invocation of the fuzzed uniform resource identifier.

2. The computer-implemented system of claim 1, wherein the memory further stores computer-executable instructions for:

receiving, by the fuzzer, a template file including the at least one valid uniform resource identifier.

3. The computer-implemented system of claim 1, wherein the memory further stores computer-executable instructions for:

recording, by the debugger, the effects of the invocation of the fuzzed uniform resource identifier and presenting the effects.

4. The computer-implemented system of claim 1, wherein the suggested fuzzing includes appending a portion of the fuzzed uniform resource body of the fuzzed uniform resource identifier to the one or more subsequent valid uniform resource identifier bodies.

5. The computer-implemented system of claim 1, wherein the memory further stores computer-executable instructions for:

presenting, by the debugger, abnormalities that are above a threshold level of threat.

6. The computer-implemented system of claim 5, wherein the threshold level of threat is set based on user preferences.

7. The computer-implemented system of claim 1, wherein the memory further stores computer-executable instructions for:

obtaining, by the fuzzer, a plurality of uniform resource identifier headers corresponding to a plurality of supported uniform resource identifier protocols.

8. The computer-implemented system of claim 7, wherein the memory further stores computer-executable instructions for:

identifying, by the fuzzer, the plurality of supported uniform resource identifier protocols from the target application.

9. A computer-implemented method comprising:

fuzzing, by a fuzzer on a computing device, at least one valid uniform resource body to generate a fuzzed uniform resource identifier body;

appending a uniform resource identifier header to the fuzzed uniform resource identifier body to create a fuzzed uniform resource identifier;

monitoring, by a debugger on the computing device, a target application for effects of invocation of the fuzzed uniform resource identifier; and

automatically outputting, by the debugger to the fuzzer, suggested fuzzing for one or more subsequent valid uniform resource identifier bodies based, at least, on monitored effects of the invocation of the fuzzed uniform resource identifier.

10. The computer-implemented method of claim 9, further comprising:

flagging, by the debugger, the fuzzed uniform resource identifier based on the monitored effects of the invocation of the fuzzed uniform resource identifier.

11. The computer-implemented method of claim 9, further comprising:

compiling, by the debugger, a report of the effects of the invocation of the fuzzed uniform resource identifier.

12. The computer-implemented method of claim 9, wherein the suggested fuzzing includes appending a portion of the fuzzed uniform resource body of the fuzzed uniform resource identifier to the one or more subsequent valid uniform resource identifier bodies.

13. The computer-implemented method of claim 9, further comprising:

obtaining, by the fuzzer, a plurality of uniform resource identifier headers corresponding to a plurality of supported uniform resource identifier protocols.

14. The computer-implemented method of claim 13, further comprising:

identifying, by the fizzer, the plurality of supported uniform resource identifier protocols from the target application.

15. The computer-implemented method of claim 9, further comprising:

presenting, by the debugger, abnormalities that are above a threshold level of threat.

16. The computer-implemented method of claim 15, wherein the threshold level of threat is set based on user preferences.

17. A computer-readable memory storing computer-executable instructions that, when executed by a computing device, cause the computing device to perform operations comprising:

fuzzing, by a fuzzer on the computing device, at least one valid uniform resource identifier body to generate a fuzzed uniform resource identifier body;

appending a uniform resource identifier header to the fuzzed uniform resource identifier body to create a fuzzed uniform resource identifier;

monitoring, by a debugger on the computing device, a target application for effects of invocation of the fuzzed uniform resource identifier; and

automatically outputting, by the debugger to the fuzzer, suggested fuzzing for one or more subsequent valid uniform resource identifier bodies based, at least, on monitored effects of the invocation of the fuzzed uniform resource identifier.

18. The computer-readable memory of claim 17, further storing computer-executable instructions for:

obtaining, by the fuzzer, a plurality of uniform resource identifier headers corresponding to a plurality of supported uniform resource identifier protocols.

19. The computer-readable memory of claim 18, further storing computer-executable instructions for:

identifying, by the fuzzer, the plurality of supported uniform resource identifier protocols from the target application.

20. The computer-readable memory of claim 17, wherein the suggested fuzzing includes appending a portion of the fuzzed uniform resource body of the fuzzed uniform resource identifier to the one or more subsequent valid uniform resource identifier bodies.