Delivering Malformed Data for Fuzz Testing to Software Applications

A method of communicating between a functional test module and a fuzzing engine, the method comprising:

• issuing, by the functional test module, an initialize request to the fuzzing engine to initialize a set of data in preparation for fuzzing an application to be tested;
• and
• communicating by the functional test module, a fuzzing request to the fuzzing engine to direct the fuzzing engine to:
• (a) change a set of well-formed data into malformed data, and (b) send the malformed data to the application to present to an end-user any security vulnerability in one or more code paths configured to process the well-formed data.

A network proxy computing device comprising:

• a processor;
• and
• a memory coupled to the processor, the memory comprising computer-program instructions executable by the processor, the computerized per instructions when executed for performing operations comprising:
• intercepting a message communicated over a network to a software application;
• parsing the message to identify a set of valid input data for input into the software application;
• generating a set of malformed data from characteristics of the valid input data;
• communicating the malformed data to the software application for processing;
• and
• wherein if the software application does not properly process the malformed data, a user is put on notice that the software application has one or more security vulnerabilities in one or more corresponding code paths.