[Lecture Topic Task] Fuzzing - SubTask 1 - Set Up and Planning

[G4vp]

Objective

Prepare the environment and tools needed to perform fuzzing on the web application.

Guidelines, Feedback, and Lectures

Guidelines:

• Fuzzing: similar to property-based testing, the project incorporates fuzzing in their project using the approaches described in the fuzzing book. In particular, they use fuzzing for testing their web interface along the lines of the "Testing Web Applications" chapter.

Checklist

• [x] Research and select a suitable fuzzing tool (e.g., Burp Suite, OWASP ZAP).
• [x] Install and configure the chosen tool.
• [x] Identify relevant parts of the web interface (forms, inputs, endpoints) for fuzzing.
• [x] Verify the tool is functioning by running a simple test payload and observing responses.

Testing and Debugging

Confirm that the fuzzing tool is installed correctly and that it can send test payloads to the identified endpoints. Observe how the application responds and troubleshoot any errors.

Deadline

April 10, 2025

---

Suggested Values

• Difficulty: 4
• Urgency: 5

[YanehRuiz]

Please use the appropriate template found in #280 ! I'll removed the approval until this template is rewritten. Please tag us once it's been done for revision @G4vp

[G4vp]

@evnd04 @YanehRuiz Template edit done.

[G4vp]

Fuzzing Environment Setup Summary

Tool Selection and Setup

• Chosen Tool: OWASP ZAP

  • Free and open-source
  • Actively maintained and beginner-friendly
  • Ideal for black-box web application security testing, including fuzzing, passive/active scanning, and WebSocket inspection

• Environment:

  • Platform: Expo React Native mobile app
  • Proxy Configuration:
  • ZAP configured to listen on 0.0.0.0:8888 to allow external device traffic
  • Mobile connected to ZAP via proxy using local IP and manual proxy setup
  • HTTPS Inspection:
  • ZAP CA certificate installed and fully trusted on the mobile
  • Successfully intercepting both HTTP and HTTPS traffic from the mobile app

---

Tool Verification & Initial Test

• Manual traffic was recorded in ZAP by interacting with the mobile app
• Requests from Firebase Authentication were successfully intercepted
• Confirmed that ZAP captured:
  • API endpoints
  • Request/response pairs
  • Tokens, headers, and payloads
• Confirmed that ZAP was functioning by analyzing these requests in the History and Sites tabs

---

Identified Fuzzing Targets (So Far)

• Due to the early stage of backend development, most recorded traffic involved Firebase Authentication
• Manual browsing was used to simulate real user flows and populate ZAP’s request log

---

Testing & Debugging Insights

• Verified that ZAP is correctly installed and intercepts mobile traffic in real time
• Resolved challenges with:
  • Binding ZAP to an external IP and port
  • Handling certificate trust issues on iOS and Android
• Successfully tested the fuzzing interface using test payloads

---

Next Steps

• 256

• Because the backend is still in an early stage, not many API endpoints were intercepted. The ones that were intercepted will be tested using fuzzing in the next phase.
• For now, this task will NOT be added to the project documentation. Issue #257 will be responsible for collecting the results of the fuzzing done in this task and in #256. Once both tasks are completed, quality documentation will be produced.

P.S.:

• This comment was supposed to include some cool screenshots of the files, requests, and responses found during testing with ZAP. Unfortunately, the Linux distribution I was using crashed just as I was about to write this. Once I recover the broken partition, I’ll update this issue. That said, the core work has been completed.

[G4vp]

@YanehRuiz @evnd04

[evnd04]

Is this added in the doc?

[G4vp]

Not yet. In the ‘Next Phase’ part of my last comment, I explained why it’s not included yet. But if you really want this in the doc now, I can do it. It’s just that I’ll still have to make a lot of changes to the document later, so it’s easier for both me and everyone else to review if we add this to the documentation once all the fuzzing phases are complete.

[evnd04]

Okay sounds good to me, so i should close this subtask as completed and it would be added to the doc whenever the fuzzing is fully done?

[G4vp]

Yes