Abstract:
The exploitation of vulnerabilities in applications, network protocols or firmware
by hackers and state agencies can have serious consequences for organizations
and countries as it results in tremendous loss of money and stealing of criti cal information. Network protocols are generally implemented with the help
of a code that is responsible for transmission and reception of messages in
accordance with that protocol. This code is generally embedded within the
firmware of the device. The security of a network protocol not only depends
on the security features provided by the protocol its self but also on the
implementation. Flawed implementation can lead to serious security conse quences. Fuzzing is an automated software quality assurance and security
testing technique typically famous for finding zero days, buffer overflow and
memory corruption vulnerabilities. In this research Fuzzing is used as a secu rity testing technique to discover vulnerabilities in network protocols. SNMP
protocol implementation in Cisco routers is used as a test case scenario. The
research has proposed a generalized fuzzing methodology which can be used
for all network protocols that work in client-server model. The methodol ogy proved its effectiveness by discovering various known memory corruption
vulnerabilities and an unknown DOS vulnerability.
