DEV Community

Cover image for Automated Fuzz Testing: The Power of Code Intelligence App
Bobur Umurzokov
Bobur Umurzokov

Posted on • Originally published at


Automated Fuzz Testing: The Power of Code Intelligence App

Software applications are becoming increasingly complex, and with complexity comes an increased risk of security vulnerabilities and defects. While traditional testing methods can help identify many of these issues, they are often insufficient when it comes to discovering vulnerabilities in software that processes unstructured or user-generated input. This is where Fuzz testing, also known as fuzzing, comes in.

πŸ‘‰ In this article, we will explore what fuzz testing is, how it works, and how to achieve automated Fuzz testing for improving software security.

Learning objectives πŸ“–

You will learn and get an answer to the following questions throughout the article:

  • What's Fuzz Testing?
  • How Does Fuzz Testing Work?
  • A modern way to apply security testing with Code Intelligence.
  • An automated approach to Fuzz testing.
  • CI App Demo for Fuzz testing.

What is Fuzz Testing?

Fuzz testing is a software testing technique that involves providing unexpected, invalid, or random data as input to a program. The goal of fuzz testing is to discover vulnerabilities and defects in software applications that may not be easily discovered through other testing methods.

Fuzz testing different inputs

The basic idea behind fuzz testing is to simulate an attacker trying to exploit vulnerabilities in the software. By providing unexpected or invalid inputs, the tester is trying to discover how the program will behave under unusual circumstances. This can help identify security vulnerabilities, memory leaks, crashes, and other defects that could be exploited by attackers.

How Does Fuzz Testing Work?

Fuzz testing typically involves four main steps:

  1. Input Generation: The tester uses a fuzzing tool such as CI Fuzz or Jazzer to generate random or unexpected inputs to the software application.
  2. Input Injection: The generated inputs are then injected into the application, either through the user interface, network input, or other means.
  3. Monitoring: The application's behavior is monitored for any unusual behavior or errors, such as crashes or memory leaks.
  4. Analysis: Once the testing is complete, the results are analyzed to identify any vulnerabilities or defects in the software.

Fuzz testing steps

There are several types of fuzz testing techniques, including black-box, white-box, and grey-box fuzz testing. Black-box fuzz testing involves testing the program without any knowledge of its internal workings, while white-box fuzz testing involves testing the program with full access to its source code and internal data structures. Grey-box fuzz testing is a combination of both approaches, where the tester has some knowledge of the internal workings of the program but not full access.

What is Code Intelligence?

Code Intelligence offers automated testing solutions such as CI Fuzz is an open-source command line tool designed to create fuzz tests and automate the fuzz testing process. It can be integrated into Continuous Integration (CI) pipelines, making it easier to run and manage the testing process. For example, it can help developers ship secure software by providing the necessary integrations to test their code at each pull request. CI Fuzz supports a wide range of programming languages, including C, C++, JavaScript, Java, Kotlin, and other JVM-based languages.

You can check other projects developed by Code Intelligence on GitHub repository.

An automated approach to Fuzz testing

You can also leverage CI App together with the CLI tool to run Fuzz tests. It provides detailed reports on the results of Fuzz tests. This includes information on the number of test cases run, the number of bugs found, coverage metrics, and the severity of each bug. This helps you to prioritize and address the most critical issues first.

Follow the CI App Quick Start guide to install and configure it on your local system. For this demo purpose, we are going to use an already deployed and built-in CI App solution on the Code Intelligence website.

Now you are going to learn how to enable application security testing features with easy steps.

CI App Demo for Fuzz testing

Step 1:

Open your browser and navigate to the CI App playground on Code the Code Intelligence website and login into the system using your GitHub account. Once you logged in, you will see the CI App dashboard with the empty project because we haven’t added our project there yet (You can also play with some featured projects out there).

CI App Demo

Step 2:

Now you can try to find your first bug in your project. We are going to use a simple ready java project that has two already vulnerabilities - a SQL injection and an RCE.

Step 3:

In the navigation bar, open the Projects dropdown and click Add Project. It will open a new pop-up menu where you specify Project Name and provide a GitHub URL link to our sample Java project.

Add CI fuzz project

Step 4:

In the sample Java project, we have existing fuzz tests (You can check the test under this folder) and it has GitHub action is set up. Only thing you need us to set into a GitHub Workflow file is an action secret called CI_FUZZ_API_TOKEN with your API token. You can generate it under your Account setting on the Tokens tab.

Update the CI Fuzz token

Follow this instruction to create encrypted secrets for a repository on GitHub.

Step 5:

Up to now everything is set up, you may need to trigger your CI/CD, either manually or by submitting a new PR. Then you will be able to see the two vulnerabilities that CI Fuzz detected and step into the code directly to see the underlying causeπŸ‘. For example, to view additional details about coverage, just click Code Coverage on the left sidebar. This will show you the overall coverage and a breakdown of the coverage by file.

Test new project

What next☝️

Overall, fuzz testing is a powerful technique for improving software quality and security by identifying and fixing defects before they can be exploited by attackers or cause problems for users. Tools such as CI Fuzz is a powerful tools that can help you automate the fuzz testing process. By integrating CI Fuzz into your software development pipeline, you can save time, improve reliability, increase security, and reduce costs.

Next steps, you can observe other features of the CI App and start to develop your own tests using the programming languages you are most familiar with.

Related resources πŸ““

Recommended content πŸ’


πŸ™‹ Join the Code Intelligence Community

About the author πŸ™Ž

Visit my personal blog:

Top comments (0)

An Animated Guide to Node.js Event Loop

Node.js doesn’t stop from running other operations because of Libuv, a C++ library responsible for the event loop and asynchronously handling tasks such as network requests, DNS resolution, file system operations, data encryption, etc.

What happens under the hood when Node.js works on tasks such as database queries? We will explore it by following this piece of code step by step.